> You've made me realise a good signal for bug hunting: Search repos with lock files listed in their .gitignore.

What would be the point of that? Do you just go around hunting for bugs in random repos?

Sure, in the spirit of open source, why not? It's a hobby, and it scratches an itch. I very much enjoy deconstructing things more than putting them together.

We also live in a world where a package written by someone learning to code ended up critically underpinning the entire ecosystem and is downloaded 500 million times a month.

Ignoring the eco-terror aspect of that for now, it means there's an awful lot of code out there which is finding itself under constant attack by a fleet of hostile AI.

I don't personally believe that the solution to that is "more AI", which firstly just overwhelms maintainers and secondly surrenders our human agency to a giant machine, with a hope that the "good" side can out-spend the bad.

Nor do I think the solution is to abandon the open internet and retreat behind corporate walls into curated spaces, "benevolently" protected by giant companies.

Which means holding on to the open internet requires a human approach, and any signal to help amplify the work there is a benefit.

▲

order-matters an hour ago | parent [-]

>We also live in a world where a package written by someone learning to code ended up critically underpinning the entire ecosystem and is downloaded 500 million times a month

whoa what? which one is that?

▲

eterm 9 minutes ago | parent | next [-]

As another commenter said, it's "is-even":

https://github.com/i-voted-for-trump/is-even

From that page:

> I created this in 2014, when I was learning how to program.

I've nothing against Jon Schlinkert, it's not his fault the way we build software is more than messed up, where our build systems are so brittle that, "Throw out the universe and rebuild it from scratch" became not just acceptable, but the main way to get build systems to work reliably.

▲

hnuncommon an hour ago | parent | prev [-]

Check is-even and is-odd npm packages. https://www.npmjs.com/package/is-even

▲

vel0city 33 minutes ago | parent [-]

That's still quite a ways away from 500M+ downloads a month, more like ~4M downloads a month.

Still a huge number of downloads, don't get me wrong!

▲

eterm 5 minutes ago | parent [-]

You're right, I was reading the stats for "is-number" and mixing them up for "is-even":

https://www.npmjs.com/package/is-number

170M downloads / week.

Same author, similar vintage. Arguably a necessary package, but that just further indicates how messed up javascript was.

	▲	vel0city a minute ago \| parent [-]
		So nuts. > Arguably a necessary package Arguably a somewhat important part of a standard library!

▲

gwbas1c an hour ago | parent | prev [-]

It's also a good practice when taking a new job, especially if someone is a contractor and changes gigs every few months or years.

I've found that, when I start a job, I have to rely on smells like this to know what kind of mess (or if there is a mess) I need to clean up.