Sort of like...
TRON?
HE FIGHTS FOR THE USER, RIGHT?
Slide 14
Slide 14 text
No content
Slide 15
Slide 15 text
IT turns out....
IT IS QUITE COMPLICATED
Slide 16
Slide 16 text
FIRST OFF....
Slide 17
Slide 17 text
FIRST OFF....
DISCLOSE RESPONSIBLY!
Slide 18
Slide 18 text
No content
Slide 19
Slide 19 text
LIKE TO THE GOOD FOLKS
AT THE NODE SECURITY PROJECT
Slide 20
Slide 20 text
No content
Slide 21
Slide 21 text
THE QUESTION
IS
HOW DO WE FIND THEM?
Slide 22
Slide 22 text
No content
Slide 23
Slide 23 text
I LED AN ACADEMIC
RESEARCH STUDY
LAST YEAR
Slide 24
Slide 24 text
SHOW YOUR ALMA MATER
SOME LOVE
Slide 25
Slide 25 text
SHOW YOUR ALMA MATER
SOME LOVE
AND YES
Slide 26
Slide 26 text
SHOW YOUR ALMA MATER
SOME LOVE
AND YES
WE WROTE A FORMAL
RESEARCH PAPER
AND EVERYTHING
Slide 27
Slide 27 text
No content
Slide 28
Slide 28 text
ACADEMIC HCI
IS A LITTLE SILLY
Slide 29
Slide 29 text
ACADEMIC HCI
IS A LITTLE SILLY
WHY DO LIKERT SCALES HAVE A NAME?
Slide 30
Slide 30 text
No content
Slide 31
Slide 31 text
YOUR RESEARCH STUDY
PLEASE
TELL ME ABOUT
Slide 32
Slide 32 text
WE ASKED A
A QUESTION
LIKE ALL RESEARCH
Slide 33
Slide 33 text
THEIR COMMUNITIES?
MODULE AUTHORS
HOW DO
ANSWER QUESTIONS ABOUT
Slide 34
Slide 34 text
No content
Slide 35
Slide 35 text
EIGHT PROLIFIC MODULE AUTHORS
SMALL GROUP
OF
Slide 36
Slide 36 text
USED MOST INFREQENTLY
MOST EFFECTIVE
THE
FEEDBACK MECHANISMS
Slide 37
Slide 37 text
USED MOST INFREQENTLY
MOST EFFECTIVE
THE
FEEDBACK MECHANISMS
GITHUB ISSUES
WRITE A BLOG POST
TWITTER DISCUSSIONS
EMAIL A MAILING LIST
Slide 38
Slide 38 text
USED MOST INFREQENTLY
MOST EFFECTIVE
THE
FEEDBACK MECHANISMS
GITHUB ISSUES
WRITE A BLOG POST
TWITTER DISCUSSIONS
EMAIL A MAILING LIST
HOW DO WE
A QUESTION LIKE THIS?
BUT
ANSWER
Slide 39
Slide 39 text
BY USING
OF COURSE
Slide 40
Slide 40 text
MULTI-DEMENSIONAL
GRAPH
REPRESENTS A
Slide 41
Slide 41 text
No content
Slide 42
Slide 42 text
FROM NEW YORK
I AM
Slide 43
Slide 43 text
FROM NEW YORK
I AM
AND SO IS
Slide 44
Slide 44 text
No content
Slide 45
Slide 45 text
No content
Slide 46
Slide 46 text
ABOUT
WAS ALWAYS
Slide 47
Slide 47 text
ABOUT
WAS ALWAYS
Slide 48
Slide 48 text
AN ENGINEER
BUT I AM ALSO
Slide 49
Slide 49 text
AN ENGINEER
BUT I AM ALSO
(3&".
Slide 50
Slide 50 text
AN ENGINEER
BUT I AM ALSO
GRAPHS
RULE
EVERYTHING
AROUND
ME
Slide 51
Slide 51 text
AN ENGINEER
BUT I AM ALSO
GRAPHS
RULE
EVERYTHING
AROUND
ME Dolla Dolla Bill Y all
’
Slide 52
Slide 52 text
No content
Slide 53
Slide 53 text
GRAPHS
NOT THESE
KINDS OF
Slide 54
Slide 54 text
A
B
C
D
E
1
2
3
4
5
A
B C
D E F
A
B
C
D
E
A
B
C
D
E
F G
H
6
2
8
7
9
5
7
-3
A
B
C
D
E
Slide 55
Slide 55 text
A
B
C
D
E
1
2
3
4
5
A
B C
D E F
A
B
C
D
E
A
B
C
D
E
F G
H
6
2
8
7
9
5
7
-3
A
B
C
D
E
GRAPHS
THESE
KINDS OF
Slide 56
Slide 56 text
A
B
C
D
E
1
2
3
4
5
A
B C
D E F
A
B
C
D
E
A
B
C
D
E
F G
H
6
2
8
7
9
5
7
-3
A
B
C
D
E
THESE GRAPHS
DIFFERENT, OF COURSE
ALL OF
ARE
Slide 57
Slide 57 text
A
B
C
D
E
1
2
3
4
5
A
B C
D E F
A
B
C
D
E
A
B
C
D
E
F G
H
6
2
8
7
9
5
7
-3
A
B
C
D
E
UNDIRECTED
DIRECTECTED
WEIGHTED
TREES
BIPARTITE
Slide 58
Slide 58 text
A
B
C
D
E
1
2
3
4
5
A
B C
D E F
A
B
C
D
E
A
B
C
D
E
F G
H
6
2
8
7
9
5
7
-3
A
B
C
D
E
UNDIRECTED
DIRECTECTED
WEIGHTED
TREES
BIPARTITE
TRANSPORATION NETWORKS
INFORMATION NETWORKS
MOLECULAR CHEMISTRY
WIRELESS NETWORKS
MAJOR LEAGUE BASEBALL
DEPENDENCY MANAGEMENT
Slide 59
Slide 59 text
A
B
C
D
E
1
2
3
4
5
A
B C
D E F
A
B
C
D
E
A
B
C
D
E
F G
H
6
2
8
7
9
5
7
-3
A
B
C
D
E
UNDIRECTED
DIRECTECTED
WEIGHTED
TREES
BIPARTITE
TRANSPORATION NETWORKS
INFORMATION NETWORKS
MOLECULAR CHEMISTRY
WIRELESS NETWORKS
MAJOR LEAGUE BASEBALL
DEPENDENCY MANAGEMENT
SOUNDS COMPLICATED FOR
my tastes.
DEPENDENCY GRAPHS?
I dont know
WITH A PACKAGE.JSON FILE
na
{
"name": "pkg-a",
"dependencies": {
"pkg-b": "~1.0.4",
"pkg-c": "~2.1.3"
},
"devDependencies": {
"pkg-d": "~3.1.2"
},
"main": "./index.js"
}
Slide 64
Slide 64 text
WITH A PACKAGE.JSON FILE
nb
nc
nd
na
{
"name": "pkg-a",
"dependencies": {
"pkg-b": "~1.0.4",
"pkg-c": "~2.1.3"
},
"devDependencies": {
"pkg-d": "~3.1.2"
},
"main": "./index.js"
}
Slide 65
Slide 65 text
WITH A PACKAGE.JSON FILE
nb
nc
nd
na
{
"name": "pkg-a",
"dependencies": {
"pkg-b": "~1.0.4",
"pkg-c": "~2.1.3"
},
"devDependencies": {
"pkg-d": "~3.1.2"
},
"main": "./index.js"
}
Slide 66
Slide 66 text
WITH A PACKAGE.JSON FILE
nb
nc
nd
na
Now imagine this for 100,000+ packages!
{
"name": "pkg-a",
"dependencies": {
"pkg-b": "~1.0.4",
"pkg-c": "~2.1.3"
},
"devDependencies": {
"pkg-d": "~3.1.2"
},
"main": "./index.js"
}
Slide 67
Slide 67 text
ONLINE WITH VIDEOS
THESE TALKS
ARE ALL ALREADY
Slide 68
Slide 68 text
5
5
DR. EMMETT OCTOCAT SAYS
YOU VE GOT TO COME BACK WITH ME.
BACK TO GITHUB!
’
“
”
Slide 69
Slide 69 text
5
5
DR. EMMETT OCTOCAT SAYS
YOU VE GOT TO COME BACK WITH ME.
BACK TO GITHUB!
’
“
”
indexzero/npm-codependencies
indexzero/npm-comp-stat-www
indexzero/npm-static-stats
indexzero/npm-pipeline
Slide 70
Slide 70 text
QUESTIONS
THE GRAPH?
WHAT OTHER
CAN WE ASK FROM
Slide 71
Slide 71 text
No content
Slide 72
Slide 72 text
THESE QUESTIONS
WHETHER YOU KNOW IT OR NOT
YOU PROBABLY ASK
EVERYDAY
Slide 73
Slide 73 text
NPM OUTDATED
IS A PURE GRAPH QUESTION
Slide 74
Slide 74 text
DEPEND ON WHAT OTHER MODULES?
WHO DEPEND ON X
ALSO
PEOPLE
Slide 75
Slide 75 text
USED MORE IN PRODUCTION
OR IN DEVELOPMENT?
ALSO
IS THIS MODULE
Slide 76
Slide 76 text
THIS MODULE?
“ ”
MOST STABLE Version
OF
WHAT IS THE
Slide 77
Slide 77 text
STATIC ANALYSIS
OTHER QUESTIONS NEED
TO BE ANSWERED
Slide 78
Slide 78 text
A PARTICULAR METHOD?
DO OTHER MODULES
USE
HOW OFTEN
Slide 79
Slide 79 text
VERSION X.y.Z SAFELY?
BE UPGRADED TO
USE
CAN MY APP
Slide 80
Slide 80 text
No content
Slide 81
Slide 81 text
SO Getting BACK
TO SECURITY
QUESTIONS
Slide 82
Slide 82 text
SHELLSHOCK?
ARE VULNERABLE
TO
HOW MANY MODULES
Slide 83
Slide 83 text
UNSAFE REGULAR EXPRESSIONS?
OF THESE MODULES
HAVE
How many
Slide 84
Slide 84 text
UNTRUSTED USER INPUT?
MODULES
EVAL
WHICH
Slide 85
Slide 85 text
COMPUTE INTENSIVE
BUT IT IS INCREDIBLY
Slide 86
Slide 86 text
COMPUTE INTENSIVE
BUT IT IS INCREDIBLY
WHICH IS TO SAY
Slide 87
Slide 87 text
PRETTY $@ SLOW
COMPUTE INTENSIVE
BUT IT IS INCREDIBLY
WHICH IS TO SAY
Slide 88
Slide 88 text
No content
Slide 89
Slide 89 text
NPM OUTDATED
IS REALLY FAST.
EVERY DAY
THAT S HOW YOU CAN USE IT
’
Slide 90
Slide 90 text
YO DAWG I HEARD YOU LIKE NPM
BY USING
OF COURSE
Slide 91
Slide 91 text
YO DAWG I HEARD YOU LIKE NPM
BY USING
OF COURSE
ALONG WITH
DATA PIPELINE
A
Slide 92
Slide 92 text
A
B C
D E F
A
B
C
D
E
F G
H
DEPENDENCY GRAPH
AST
COMPUTATION
DOWNLOAD &
UnTAR
Slide 93
Slide 93 text
A
B C
D E F
A
B
C
D
E
F G
H
DEPENDENCY GRAPH
AST
COMPUTATION
DOWNLOAD &
UnTAR
DATA PIPELINE
ANALYSIS WORK
MODULES
THE SET OF
AND THE SPECIFIC
CHANGES BUT, THE
Stays the same
DATA PIPELINE
MAKING IT
HIGHLY PARALLELIZABLE
Slide 94
Slide 94 text
ESPRIMA + RECAST
+ npm + Data pipeline
= npm-pipeline
Slide 95
Slide 95 text
No content
Slide 96
Slide 96 text
GENERIC WORK TO PERFORM
GENERIC MODULE
AND
A
Slide 97
Slide 97 text
TENS OF SECONDS
FROM TENS of Minutes
TO
ANALYSIS TIME DOWN