A too prolific Hackage user?

https://hackage.haskell.org/user/OleksandrZhabenko

I’ve been observing the activity of this person on Hackage , and I’m a bit concerned by the large amounts of single-purpose packages they produce which amount essentially to one big monorepo.

Can anyone of our Hackage admins give this person a heads up ?

Hackage admins might or might not read Discourse.

Reporting problems

For issues with accounts or permissions please contact the administrators by email at hackage-admin@haskell.org

Bugs with the site code or server/hosting issues should be reported in the issue tracker.

Scheduled infrastructure status information is available at status.haskell.org and automated uptime information at auto-status.haskell.org. Serious issues requiring immediate action should be reported to admin@haskell.org or on the #haskell-infrastructure irc channel on libera.chat.

2 Likes

Is the main concern that it will cause some sort of performance degradation of the Hackage server?

It’s more to do with the shrinking Hackage namespace - once uploaded for general use, there’s no way to revoke a package so that its name can be freed. An infamous example of Hackage irrevocability is acme-everything.

It doesn’t look malicious at all, plenty of docs and sensible code (I’ve only looked at several packages though), even though it’s mostly oddly specific. I’d rather lean on the side of letting people upload to Hackage whatever they find valuable for themselves than to make everyone anxious of whether their work is “objectively valuable” enough.

Which name would you miss? Almost all of them are extremely specific and probably not a single other person would want their package to have such a name.

10 Likes

Which name would you miss?

I’ll let others with more Hackage knowledge/experience answer that question:

Right, but the point still stands. The user isn’t gobbling up generic names. These names are super specific. It’s only a problem if someone else wants the names.

Citing “Hackage is a finite resource” isn’t a compelling argument on its own given the context.

2 Likes

So how many packages is this person maintaining…over 100 of them. That’s a lot of packages for one person to be involved with - I for one would be worried about “burnout”:

  • if the majority of those packages have groups of maintainers, there’s some redundancy;

  • otherwise, all but a few of those packages would eventually succumb to bit-rot, but they would still appear in searches nonetheless - forever.

…actually, they’re all package candidates (in that list anyway). So my question would be:

  • can the uploader or maintainer/s remove their own package candidates from Hackage?

(…so far, my web-searches have yet to find the answer.)

Yes, I’ve done this recently when someone asked me nicely if they could have the name.

What’s the problem here? Is it that this user has uploaded “too many” packages? If so, they’re far from the most prolific user on Hackage:

  1. BrendanHay: 532 packages
  2. MichaelSnoyman: 220 packages
  3. HenningThielemann: 188 packages
  4. phadej: 179 packages
  5. NikitaVolkov: 149 packages
  6. EdwardKmett: 132 packages
  7. Norfair: 128 packages
  8. ryanglscott: 116 packages
  9. HerbertValerioRiedel: 115 packages
  10. andrewthad: 113 packages
  11. DonaldStewart: 111 packages
  12. OleksandrZhabenko: 104 packages
6 Likes

I don’t think they’re all candidates - although the Hackage UI did confuse me too :laughing: many of the packages have many versions.

  1. not necessarily
  2. even if so, it may take quite a while making it worthwhile
  3. you can’t tell which will bitrot and which will not
  4. even a bit-rotted package can be of use, because someone may fork it and fix or even just straight copy-paste the pieces that still work into their project

As for the Hackage is a finite resource concern, it can mean either of the two:

  1. mass-squatting valuable names – we very clearly don’t see that here
  2. the amount of data uploaded to Hackage is atypically large – not what we’re discussing, because a large number of maintained packages does not necessarily imply that a large amount of data is being uploaded, especially given the “single-purpose packages” part from the OP

It’s probably indeed a good idea to keep track of how much data is getting uploaded to Hackage on a daily basis / per user / per package / etc, but then it’s better to shift focus to that rather than count packages.

5 Likes

In the same way I apparently shouldn’t be concerned about matters like bitrot, maintainer “burnout”, or the depletion of the Hackage name space, perhaps you shouldn’t be so concerned about deciding on what is atypical or otherwise with regards to uploading - the Hackage infrastructure should be able to cope with the addition of more storage, at least in the short to medium term. But I’m no chreekat either…

I’m not attempting to tell you what you should or shouldn’t be concerned about, just expressing my subjective opinion, please feel free to disagree (or ignore etc).

Didn’t mean to do that, only suggested that if we were to discuss these matters, it would make sense to discuss them rather than some arbitrary metric such as the number of packages uploaded by a person.

Remark: each service binding for both amazonka and gogol was split out into its own package so you only built the necessary service bindings — those packages predate the ability for Cabal to have multiple public libraries, and have been held back by other tools (e.g., Stack, nixpkgs) being slow to support this feature. (Eventually, I hope to consolidate amazonka, but there’s a lot that needs to happen first.)

4 Likes

About time we blocked Edward from polluting the namespace :sweat_smile:

Agreed, big -1 for making hackage a “I find this useful or not”-democracy.

If people want user namespaces, make cabal and hackage support them: Namespacing packages · Issue #924 · haskell/hackage-server · GitHub

10 Likes

how about “polluting a common resource with irreversible changes”, does that resonate instead?

If you’re worried, try to contact the person first (the email address is there and public).

Then contact the hackage admins.

Why this is a thread here I don’t understand. Public escalation shouldn’t be the first option. Maybe they’ll be embarrassed reading this and don’t know how to structure packages properly? Who knows.

6 Likes

I put this out for discussion to calbirate my understanding first. As it’s plain from the answers above, it’s unclear how to address this sort of issue.