I applaud this action and while I'd like to point the finger at NPM, there's no real other method to fix historical package versions that depend on this. It is worth pointing to the silly state of NPM packages: Who decided that an external dependency was necessary for a module that is 17 lines of code? module.exports = leftpad; function leftpad (str, len, ch) { str = String(str); var i = -1; if (!ch && ch !== 0) ch =…
I've Just Liberated My Modules
91–100 of 827 posts
Re: I've Just Liberated My Modules
#92That's pretty much the worst handling of this issue I could ever imagine. Spine-less flip-flopping–because taking a stand would have been too inconvenient. What did people expect from some 20 year olds managing a centralized piece of infrastructure?
What's "flip-flopping"? The package restored is not the one the trademark issues were about.
Re: I've Just Liberated My Modules
#93Earlier quoted context omitted.
Personally i'm going to use an installable module for something even that small, because i can, and it works. The benefits from an install registry don't go away just because the module is very tiny... Why would i spend my time re-inventing the wheel for every little thing i do? And if i'm not reinventing, then i'd be copy/pasting which is much worse. At best that's a waste of time and effort to properly document the…
By this logic, every Stack Overflow snippet should be a module. I'm almost hesitant to suggest this since many people who read this will be capable of building such a thing.
I'm not saying that everything should be a module, but that well designed, well tested bits of code should be modules.
These 17 lines had 100% test coverage and were used by a stupidly large amount of people (read: battle tested), why not use it?
As is pointed out elsewhere in this thread, echo.c is roughly the same size, does that mean it's not a worthy program?
Re: I've Just Liberated My Modules
#94Was that lawyer overreaching? I don't know. But for this guy to expect npm to use their resources to defend him (which they may even possibly lose!) and get mad at them is... a bit presumptuous? Github isn't open source either so is he going to get mad when the lawyers send them an email about kik?
It's so easy to avoid name collisions that it doesn't even make much sense to think about it. And trademarks aren't even a feature of the capitalism he so seems to hate: OSS uses names for the same marketing purpose as companies do and larger projects register those trademarks.
Re: I've Just Liberated My Modules
#95I applaud this action and while I'd like to point the finger at NPM, there's no real other method to fix historical package versions that depend on this. It is worth pointing to the silly state of NPM packages: Who decided that an external dependency was necessary for a module that is 17 lines of code? module.exports = leftpad; function leftpad (str, len, ch) { str = String(str); var i = -1; if (!ch && ch !== 0) ch =…
I think you're mistaken about the caret semver specifier. Using the caret for versions less than 0.1.0 offers no flexibility at all.
For 0.0.x versions of packages the caret means "this version and this version only", so it won't break anything here...
Source: https://docs.npmjs.com/misc/semver#caret-ranges-123-025-004
Re: I've Just Liberated My Modules
#96FYI I'm the one who republished left-pad after it was unpublished.
I think of it similar to letting a domain name expire. The original author removed the code and I forked it and published a new version with the same package name.
The main issue was there were so many hard coded dependencies to 0.0.3 so I asked npm support if they could allow me to re-publish that version and they complied since I was now the maintainer of that package.
Re: I've Just Liberated My Modules
#97The fact that this is possible with NPM seems really dangerous. The author unpublished (erm, "liberated") over 250 NPM modules, making those global names (e.g. "map", "alert", "iframe", "subscription", etc) available for anyone to register and replace with any code they wish. Since these libs are now baked into various package.json configuration files (some with 10s of thousands of installs per month, "left-pad" with…
Ideas for improvement:
- Add 2 factor authentication for npm publish
- When you npm install, add a warning for all the versions that got published without 2 fac
- pre-install/post-install scripts should require user to accept or refuse. The simple action of running npm install shouldn't run arbitrary code.
- make shrinkwrap by default (and fix all the issues with it) so that running npm install doesn't use different versions when used over time.
- make updating a version an explicit decision via npm upgrade
Re: I've Just Liberated My Modules
#98Re: I've Just Liberated My Modules
#99Wow, this is an amazing outcome here.
Why is "unpublishing" something that can happen in npm? What's the point? I can see the downside, what's the upside?
Re: I've Just Liberated My Modules
#100Azer has contributed awesome modules to the community, but such a move _obviously_ messes with a bunch of people who previously didn't trust npm, but Azer. Npm works fine. There might be issues with it, but the reason builds are failing right now is that he decided to unpublish all of them - in a move that feels very kneejerky, despite him claiming that it's the opposite. If this had been actually in the interest of…
How does a 30-day notice work unless you have a way of reaching out to people using your modules? It just seemed so unrealistic that even 1% of people would actually see such a notice before things start to fall apart.