Hacker News Reader

Maybe everyone else is too young to remember left-pad, but in the wake of left-pad everyone learned that one of the primary selling points of dedicated dependency repositories is that they can refuse to support "unpublishing" a dependency, which is not a guarantee that Github (or any other popular forge) makes.

View on HN

There's no such thing as refusing to unpublish, not if you want to avoid prison time.

Package contains child porn, what now?

I think it's implied to be refusing to unpublish at the request of the author; unpublishing due to outside forces is probably inevitable. If some unsupportable content got introduced in a new version (e.g. xz), at least the historical versions would be kept.

That of course brings in questions of cost, trust, and governance, so there's definitely a trade-off…

> Maybe everyone else is too young to remember left-pad

It wasn't that long ago...

Ten years as of March 22...

In the AI age, 6 months seems to be percieved as a long time ago. 6 months feels like yesterday to me.

Reply on news.ycombinator.com