YHK - yet another hacker news clone

My temporary PHP fix from 2014 has nearly 20M installs. Today I'm deprecating it

197 points jakeasmith 1 day ago 50 comments

jakeasmith 1 day ago | parent

Author here, happy to answer any questions. I never imagined a polyfill for http_build_url would gain so much traction. After 12 years, deprecating it feels like the right move, especially given the new options from the community and PHP itself.

HackerThemAll 4 hours ago | parent

The JavaScript world is littered with stuff comparing to which your patch seems like a complex project. See those examples:

https://www.npmjs.com/package/is-odd

https://www.npmjs.com/package/is-even

https://www.npmjs.com/package/left-pad

https://www.npmjs.com/package/is-whitespace-character

https://www.npmjs.com/package/isarray

JaggerJo 4 hours ago | parent

what a broken ecosystem.. The crazy thing is not that the package exists, but that it is used by JS devs.

yurishimo 4 hours ago | parent

There’s a bit more nuance as to why. It’s not fair to say that the average JS dev is reaching for a package like is-odd/is-even.

Years ago when npm was just getting started there was a lot of experimentation and land grabbing for packages. A few “prolific” developers were pushing these tiny utilities and then using them in their own projects which ended up being required as deps in other projects and then snowballed into is-odd being included in webpack at some point (I think I have that timeline roughly correct).

It’s still a crappy problem for sure but it’s not fair to paint most JS devs with a brush so broad.

junon 4 hours ago | parent

I feel like I have to remind people of this quite often, but the history is such that npm was lightweight at one point, bundling wasn't a thing, and while `isodd`/`iseven` are of course silly, things like `isarray` were not functions that existed back then (we didn't have Array.isArray). `typeof [] === 'object'` in JS, so e.g. my package `is-arrayish` checked for a similar structure to an array (whereas Id guess `isarray` checked for the prototype). `isarray` failed for the `arguments` keyword, which was needed for variadics before argument spreads were added to the language I believe in ES5.

So of course they don't make sense now. But they were created for a reason. Before even Markov chains were a fad - let alone LLMs - we were trying to be as efficient as possible and maximize code reuse I stead of writing the same helper functions over and over again. That's what you're seeing.

b112 3 hours ago | parent

I hate to bring politics into such discussions, but this thought struck me as funny.

The hubris of humanity... what you're describing is akin to the US Constitution and the Founding Father's goals, ending in Donald Trump.

Node is the same horror.

Nice ideas, great premise, and all turned to garbage in the end.

junon 3 hours ago | parent

I think a lot of things end up that way, just at different timescales. Best we can do is learn from them and start again, IMO - however that looks.

toyg 3 hours ago | parent

"The road to Hell is paved with good intentions". Still true, probably thousands of years after the sentence was coined.

austin-cheney 29 minutes ago | parent

Everything that touches JavaScript in the corporate world feels broken.

Look at any full stack job post. It’s a mess of tech stack nonsense on the backend for people who are terrified of JavaScript and a layering of framework madness on the frontend for people who are still terrified of JavaScript. So it should be no surprise to see packages like those in common use when people aren’t really writing, or even reading, the real code anyways.

That is just the coding aspect of it. There are many additional challenges to working with a bunch of cowards whose primary job is to pretend to be something they clearly aren’t.

domh 1 hour ago | parent

These packages are basically memes at this point... Those download figures cannot be accurate for real production usage.

I don't believe any programmer is actually using these. isarray and left-pad are at least functions that didn't used to be in the standard library, to slightly excuse them.

sumtechguy 17 minutes ago | parent

I would not bet on that assumption. I have seen some wild code over the years from devs. With 'ai' type coding going on now too you may see them be used even more.

domh 14 minutes ago | parent

I would've actually thought AI would slightly improve upon this situation. At least in my experience claude seems to write a lot more little utility functions itself rather than reaching for a package from npm to do something. Requiring an `npm install` before getting something working risks triggering a permissions gate.

whywhywhywhy 2 minutes ago | parent

Major libraries used them so yeah the numbers are real, left-pad was in every react and babel install.

vachina 42 minutes ago | parent

Whenever I see a npmjs project I nope out of it. I’d rather spend $50 on tokens to reimplement whatever JS slop in Python or Go.

layer8 3 hours ago | parent

I’d say the deciding factor is that it has bugs where both fixing and not fixing them can have a negative impact. If there were no known bugs and there was no harm in using it, I’d probably just leave it there and not disturb anything, given that its use is so widespread, and instead merely note in the documentation that its purpose has become obsolete.

dolmen 3 hours ago | parent

From the article:

> So I had a decision to make. I could dive back into PHP after almost a decade away, hand the package to one of the people who’d offered, or let it keep sitting there.

We are in the AI era. As a maintainer of an open source project that I haven't touched for years, I would first start by asking an AI to produce a fix for the issue and check what it proposes. This definitely reduces the mental load and risk of breaking an old codebase that so many users depend on.

Deprecating the project is playing the open source game in an other dimension: tell the word that depending on this project was a bad idea in the first place and that everyone should move on. But releasing a fix on a deprecated project is fine too.

So both actions are on different dimensions, this isn't a choice between 2 options.

jjice 2 hours ago | parent

The man released a fix twelve years ago for free. If someone is really depending on this, they can fork it themselves. I'd argue that that's the beauty of open source, rather than a downside.

mech422 2 hours ago | parent

The down vote was me - I really think calling deprecating a project after a decade+ telling the world 'depending on this project was a bad idea' is tone deaf.

lukeify 2 hours ago | parent

Others would say pragmatic.

iso1631 2 hours ago | parent

I think it shows a complete misunderstanding on what free software is.

dspillett 1 hour ago | parent

Free software is Free (and free software is free, libre software is libre, …, where the free/Free/libre/OS/… distinctions are relevant). That does not guarantee continued maintenance for decades, and to expect such is the sort of entitlement that puts some people off sharing their work and playthings.

dspillett 2 hours ago | parent

It doesn't say that depending on it was a bad idea, but that depending on it going forward is a bad idea, and they've gone the extra mile and made an announcement including information about what better alternatives are not available.

Would you prefer it just sat there unfixed and unsupported?

post-it 2 hours ago | parent

Why don't you do it?

serial_dev 2 hours ago | parent

We are in the AI era, it doesn't change the fact that investing 1 hrs a month (or even a week) into a long-dead project in a language you no longer use is more investment than 0 hours for the rest of your life.

And yes, if your timeline as a dependency enjoyer is "is this project going to be maintained for 15 years" and you still assumed the answer is yes, it's kind of on you adding a dependency.

dspillett 2 hours ago | parent

Even with AI, the result needs to be reviewed both to make sure it is actually correct in what it intends to do and that it does not have knock-on effects anywhere else. Given the description of the bug I'd think that spinning up the AI and pointing it in the right direction would save no time over just fixing the issue completely by hand.

Fixing the issue could set an expectation in current users of the package that it might get updates going forward, which it obviously won't from this maintainer, potentially reducing any impetus that might exist to move over to something that is a more correct solution these days. Handing over control of the project where it is has risks which are stated in TFA.

So while both fixing and deprecating could have been done, I think the right choice (just mark it as deprecated) has been made. Not fixing the existing bug(s) will not break anything that is using the package any more than it is already broken. If one of the existing issues had potential to be a security issue then I might err more towards fix+deprecate (with big red text included in any announcement of the fix to the effect that this is the last one and future issues won't get resolved upstream).

nkrisc 1 hour ago | parent

The cool thing about open source is anyone can fork it and spend their own money asking AI to make a fix.

amhoab 6 hours ago | parent

We used to work together at AOL. Glad to see you on here; I hope you're doing great!

yard2010 6 hours ago | parent

Reading this threw me back to 2014 - how was working for AOL back then?

Codefrontier 6 hours ago | parent

Love you kept it alive this long

hdjrudni 5 hours ago | parent

It hasn't been updated in 11 years. Not sure I'd call that "keeping it alive".

duskdozer 3 hours ago | parent

It doesn't seem to have gone moldy considering how many people have installed it in recent time.

dspillett 1 hour ago | parent

Sometimes not touching something that works is the best way to keep it working!

Sander_Marechal 6 hours ago | parent

There is nothing as permanent as a temporary fix that works.

laruss5 6 hours ago | parent

For a package with that kind of install base, is there a final release that prints the migration options in a deprecation notice? People will find it years from now through old Stack Overflow answers.

TimWolla 6 hours ago | parent

The package is marked as abandoned on Packagist [1]

> This package is abandoned and no longer maintained. No replacement package was suggested.

Both adding it as a dependency using composer and installing it from a lockfile results in:

    $ composer require jakeasmith/http_build_url
    […]
    Package jakeasmith/http_build_url is abandoned, you should avoid using it. No replacement was suggested.
    […]
    $ rm -r vendor/
    $ composer install
    […]
      - Installing jakeasmith/http_build_url (1.0.2): Extracting archive
    Package jakeasmith/http_build_url is abandoned, you should avoid using it. No replacement was suggested.
    […]
[1] https://packagist.org/packages/jakeasmith/http_build_url

Timwi 2 hours ago | parent

It would have been nice if a replacement had been suggested.

0x073 1 hour ago | parent

Replacement is defined in the github repo, in composer you can only define an replacement package, but there is no real replacement, just alternative ways.

pmlnr 1 hour ago | parent

Read the linked entry.

crumb1e 4 hours ago | parent

Reading this made me really nostalgic. I cut my teeth in web/software dev in the Laravel 5.x days, and it's quite jarring comparing the day-to-day we have now with back then!

AltruisticGapHN 4 hours ago | parent

Should the repo be archived?

I rarely see people use that feature yet tons of repos on Github are essentially dead.

jamietanna 3 hours ago | parent

+1 on this - Jake's done the best thing with deprecating the package (which shows up locally in tooling and will also be surfaced by static analysis tooling (ie security vendors) based on that, but also archiving the repo indicates it to anyone who lands on the repo

edg5000 3 hours ago | parent

Crazy that the bug went unnoticed. So many sites must have been broken by the "a" bug.

dspillett 1 hour ago | parent

It only kicks in in the presence of a trailing / - perhaps this is rare where the function is commonly used.

samayashar 3 hours ago | parent

Thanks for pointing this out. I used PHP for one of my professional projects and never came through this - maybe because the library was not a part of our codebase.

This article will be very useful for people who might shift back to older PHP versions for compatibility and face it.

algoth1 3 hours ago | parent

Are you from Nebraska?

gitowiec 1 hour ago | parent

Omg, PHP... I ditched this language 7 years ago, because I was fed up with the context switching (fullstack webdev). In the beginning I really was enjoying the gentle slope of learning. I could do a lot without knowing what classes, objects and types are. And I am grateful for this, because thanks to it, now I am here where I can do much more powerful things knowing classes, objects, types and paradigms

alt227 1 hour ago | parent

PHP kept on getting professional attention and development, and so now it also has all those things you mentioned.

shevy-java 46 minutes ago | parent

PHP makes me so sad.

hk__2 35 minutes ago | parent

> Along with the numbers, there were a handful of GitHub issues, including one where joining a path onto a URL with a trailing slash strips every letter “a” out of the path.