Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I've Just Liberated My Modules

medium.com

Post reply on HN
Print view View original

41–50 of 827 posts

Re: I've Just Liberated My Modules

#41

Post by MaulingMonkey »

gnaritas wrote: post #23
jlg23 wrote: post #12

Seriously? "When I started coding Kik, didn’t know there is a company with same name. And I didn’t want to let a company force me to change the name of it. After I refused them, they reached NPM’s support emphasizing their lawyer power in every single e-mail CC’ing me. I was hoping that NPM would protect me, because I always believed that NPM is a nice organization." a) Ignorance is no excuse. b) Expecting others to…

> Wrong, that is the prototype of a knee-jerk action. No it isn't; and he made that clear, he objects to their actions and is taking action of his own. > Last but not least, whining about it in public in the hope "something will happen" is pathetic. No, it's called protesting, and it's exactly the correct thing to do. Calling it pathetic is itself pathetic. > hat I'd suggest (though now it is too late): Rename the mo…

> You're completely missing his point if you think this suggestion is at all reasonable.

Is this the kik we're talking about?

http://dev.kik.com/ https://trademarks.justia.com/858/93/kik-85893307.html

Is the point that kik should just give up on their company trademark?

Re: I've Just Liberated My Modules

#42

Post by st3v3r »

oldmanjay wrote: post #35
gnaritas wrote: post #23

Earlier quoted context omitted.

> Wrong, that is the prototype of a knee-jerk action. No it isn't; and he made that clear, he objects to their actions and is taking action of his own. > Last but not least, whining about it in public in the hope "something will happen" is pathetic. No, it's called protesting, and it's exactly the correct thing to do. Calling it pathetic is itself pathetic. > hat I'd suggest (though now it is too late): Rename the mo…

He made it clear he doesn't want to consider it a knee jerk, which has approximately zero relationship to whether it actually is. Protesting trademark law sounds like a lot of useless fun. It may be the "correct" thing to do, but it will have no result.

He's not protesting trademark law; he's protesting that NPM just handed over his module to someone else.

Re: I've Just Liberated My Modules

#43

Post by callmevlad »

The fact that this is possible with NPM seems really dangerous. The author unpublished (erm, "liberated") over 250 NPM modules, making those global names (e.g. "map", "alert", "iframe", "subscription", etc) available for anyone to register and replace with any code they wish.

Since these libs are now baked into various package.json configuration files (some with 10s of thousands of installs per month, "left-pad" with 2.5M/month), meaning a malicious actor could publish a new patch version bump (for every major and minor version combination) of these libs and ship whatever they want to future npm builds. Because most package.json configs use the "^1.0.1" caret convention (and npm --save defaults to this mode), the vast majority of future installs could grab the malicious version.

@seldo Is there a plan to address this? If I'm understanding this right, it seems pretty scary :|

[1] https://medium.com/@azerbike/i-ve-just-liberated-my-modules-...

Re: I've Just Liberated My Modules

#44

Post by profmonocle »

mathetic wrote: post #30
cammsaul wrote: post #8

Update: NPM takes "unprecidented action [...] given the severity and widespread nature of the breakage" and un-un-publishes left-pad https://twitter.com/seldo/status/712414400808755200

This is incredible. They screwed the author about ownership once and then they did exactly the same thing again.

Did they? Most open source licenses aren't revokable - you don't have to stop distributing the code just because the author asks you to stop. That seems especially true in this case, considering the author chose[1] to license left-pad under the WTFPL[2]. I'd say re-publishing the package counts as NPM doing "whatever the f* they want" with the code.

[1] https://github.com/azer/left-pad/blob/master/package.json

[2] http://www.wtfpl.net/txt/copying/

Re: I've Just Liberated My Modules

#45

Post by joshmanders »

larkinrichards wrote: post #31

I applaud this action and while I'd like to point the finger at NPM, there's no real other method to fix historical package versions that depend on this. It is worth pointing to the silly state of NPM packages: Who decided that an external dependency was necessary for a module that is 17 lines of code? module.exports = leftpad; function leftpad (str, len, ch) { str = String(str); var i = -1; if (!ch && ch !== 0) ch =…

https://en.wikipedia.org/wiki/Unix_philosophy

Re: I've Just Liberated My Modules

#46

Post by jlg23 »

celtain wrote: post #34
jlg23 wrote: post #26

Earlier quoted context omitted.

EDIT: For those with a short attention span, the first paragraph is a drastic metaphor, the second is making my point. If a kid does not get cookies at home it can shoot all its classmates. Lots of media coverage, the kid will get "the attention of an incredible number of people very quickly". NO. For me, publishing code under a FOSS-license means giving back to the community. Anyone who then decides to cause collate…

I think you missed the caveat about the actual damage caused. Wasting people's time is nowhere close to murder.

And I think you missed the point of my response. I chose a admittedly drastic picture to get across the point about causing collateral damage.

Re: I've Just Liberated My Modules

#47

Post by airless_bar »

ch4s3 wrote: post #13
airless_bar wrote: post #10

That's pretty much the worst handling of this issue I could ever imagine. Spine-less flip-flopping–because taking a stand would have been too inconvenient. What did people expect from some 20 year olds managing a centralized piece of infrastructure?

No, the original author didn't change his mind. The people at NPM undid his unpublishing so that peoples' builds would pass while the mess gets sorted out.

That's exactly what I said.

Re: I've Just Liberated My Modules

#48

Post by jsprogrammer »

felixrieseberg wrote: post #21

Azer has contributed awesome modules to the community, but such a move _obviously_ messes with a bunch of people who previously didn't trust npm, but Azer. Npm works fine. There might be issues with it, but the reason builds are failing right now is that he decided to unpublish all of them - in a move that feels very kneejerky, despite him claiming that it's the opposite. If this had been actually in the interest of…

Didn't NPM break builds by completely swapping out the contents of a known module?

Obviously NPM should not be relied on, but this really makes the case.

NPM will arbitrarily modify packages without notice -- this could be the unwinding of NPM.

Re: I've Just Liberated My Modules

#49

Post by gojomo »

al2o3cr wrote: post #20

"eventually create a truly free alternative for NPM." Which will either comply with copyright laws, or get blasted off the 'netz and break everyone's build... The rules are messed up, but dramatic gestures and abstract hopes that "free software will save us" aren't going to fix them.

This is a trademark dispute, not a copyright dispute. (And since Kik the company doesn't market a product in the field of command-line programmer tools, whether they have a legitimate case is arguable.)

There are other distribution architectures, both organizational and technical, which would be more resistant to IP claims, especially frivolous ones.

Re: I've Just Liberated My Modules

#50

Post by krainboltgreene »

callmevlad wrote: post #43

The fact that this is possible with NPM seems really dangerous. The author unpublished (erm, "liberated") over 250 NPM modules, making those global names (e.g. "map", "alert", "iframe", "subscription", etc) available for anyone to register and replace with any code they wish. Since these libs are now baked into various package.json configuration files (some with 10s of thousands of installs per month, "left-pad" with…

That's not how it works. You can't publish left-pad 0.0.3 again.
Post reply on HN