Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I've Just Liberated My Modules

medium.com

Post reply on HN
Print view View original

121–130 of 827 posts

Re: I've Just Liberated My Modules

#121

Post by piotrkaminski »

steveklabnik wrote: post #87
gariany wrote: post #80

Earlier quoted context omitted.

a) from what I understand, his project was there first. b) NPM shouldn't have to fight it unless they are requested to, the trademark claim was ridiculous to begin with. Regardless of the claim, enforcing it would have taken years... I'm not saying NPM shouldn't have comply with the request and rename the package but definitely could/should have handled this better. c) the guy wrote: "NPM is no longer a place that I’…

> the trademark claim was ridiculous to begin with. npm's lawyers disagree with you, and they're lawyers. EDIT: cool HN, -2 for stating a fact. Sure, I don't disagree that this lawsuit is kind of silly, but npm's laywers don't think this suit is _frivolous_, which is what matters.

Layers tend to be conservative, and have also been known to make mistakes. I don't think it's crazy to question their decisions.

Re: I've Just Liberated My Modules

#122

Post by gariany »

steveklabnik wrote: post #87
gariany wrote: post #80

Earlier quoted context omitted.

a) from what I understand, his project was there first. b) NPM shouldn't have to fight it unless they are requested to, the trademark claim was ridiculous to begin with. Regardless of the claim, enforcing it would have taken years... I'm not saying NPM shouldn't have comply with the request and rename the package but definitely could/should have handled this better. c) the guy wrote: "NPM is no longer a place that I’…

> the trademark claim was ridiculous to begin with. npm's lawyers disagree with you, and they're lawyers. EDIT: cool HN, -2 for stating a fact. Sure, I don't disagree that this lawsuit is kind of silly, but npm's laywers don't think this suit is _frivolous_, which is what matters.

3 letters of a NPM developers package? for real?? I'm pretty sure the owners of Kik wouldn't care that that developer package is named Kik. I can find 1000s of mentions of Kik online which validates the trademark. Starting from @kik on twitter to an online project of a random student.

Pursuing a NPM package names?????? for real?!

If you've ever worked with lawyers you would have known that they would always be on the conservative (safe) side without understand the business implications.

Re: I've Just Liberated My Modules

#123

Post by jwiley »

I think that unfortunately this was a foregone conclusion. Copyright law, like most other laws in our society, favor corporate interests.

I support his stand on principal, however. Azer is a talented developer and has an impressive life story, and has certainly contributed more to society than a social network well know for invading children's privacy.

https://medium.com/@azerbike/i-owe-my-career-to-an-iraqi-imm...

https://en.wikipedia.org/wiki/Kik_Messenger#Controversies

Re: I've Just Liberated My Modules

#124

Post by hippich »

x0ner wrote: post #17

Not sure I follow this completely... You start a project with the same name as a company, which owns the registered brand and are surprised when some 3rd party complies with legal suggestions to make an adjustment? Seems kind of silly to expect that NPM would want to fight for your project name when you didn't seem to do your own due diligence when picking a name. Also, a bit backwards to go remove all your modules a…

trademarks do not work this way. in order to infringe on trademark, you actually have to be in the same business. OP did not want to fight a legal fight, which is understandable. And NPM can on their own discretion to do whatever they want, and they prefer to avoid legal battles as well.

Re: I've Just Liberated My Modules

#125

Post by Klathmon »

chrisfosterelli wrote: post #112
callmevlad wrote: post #59

Earlier quoted context omitted.

Yes, but I can publish an evil left-pad@0.0.10, and if you're not shrinkwrapping or any sub-dependency has left-pad: "^0.0.3", it will pull in the evil 0.0.10 version. EDIT: I stand corrected. See below, looks that's not the case specifically for "0.0.x" versions, but gets progressively more relaxed if there's a non-zero minor version specified. However, many of the unpublished packages had varying major and minor ve…

No it won't... The caret specifier for 0.0.x packages means "this version and this version exactly ".

He's right, for `0.0.x` versions it means "this version and this version exactly"

https://docs.npmjs.com/misc/semver#caret-ranges-123-025-004

And to be honest, it's news to me. Sorry i impulse downvoted you...

Re: I've Just Liberated My Modules

#126

Post by guelo »

bentlegen wrote: post #58
krainboltgreene wrote: post #50

Earlier quoted context omitted.

That's not how it works. You can't publish left-pad 0.0.3 again.

Unless you're npm: https://twitter.com/seldo/status/712414400808755200

So left-pad is too important to be removed but Kik isn't? What if the author had originally called left-pad Kik? Why is it ok for the Kik trademark holder to break thousands of builds but not the module author?

Re: I've Just Liberated My Modules

#127

Post by nmjohn »

chrisfosterelli wrote: post #112
callmevlad wrote: post #59

Earlier quoted context omitted.

Yes, but I can publish an evil left-pad@0.0.10, and if you're not shrinkwrapping or any sub-dependency has left-pad: "^0.0.3", it will pull in the evil 0.0.10 version. EDIT: I stand corrected. See below, looks that's not the case specifically for "0.0.x" versions, but gets progressively more relaxed if there's a non-zero minor version specified. However, many of the unpublished packages had varying major and minor ve…

No it won't... The caret specifier for 0.0.x packages means "this version and this version exactly ".

Some examples of how it works:

    ^1.2.3 := >=1.2.3 =0.2.3 =0.0.3

Re: I've Just Liberated My Modules

#128

Post by [deleted] »

jonahx wrote: post #106
callmevlad wrote: post #43

The fact that this is possible with NPM seems really dangerous. The author unpublished (erm, "liberated") over 250 NPM modules, making those global names (e.g. "map", "alert", "iframe", "subscription", etc) available for anyone to register and replace with any code they wish. Since these libs are now baked into various package.json configuration files (some with 10s of thousands of installs per month, "left-pad" with…

This seems like a serious security risk. Is there any solution? Would using version numbers without the caret work?

[deleted]

Re: I've Just Liberated My Modules

#129

Post by hartator »

steveklabnik wrote: post #87
gariany wrote: post #80

Earlier quoted context omitted.

a) from what I understand, his project was there first. b) NPM shouldn't have to fight it unless they are requested to, the trademark claim was ridiculous to begin with. Regardless of the claim, enforcing it would have taken years... I'm not saying NPM shouldn't have comply with the request and rename the package but definitely could/should have handled this better. c) the guy wrote: "NPM is no longer a place that I’…

> the trademark claim was ridiculous to begin with. npm's lawyers disagree with you, and they're lawyers. EDIT: cool HN, -2 for stating a fact. Sure, I don't disagree that this lawsuit is kind of silly, but npm's laywers don't think this suit is _frivolous_, which is what matters.

If npm's lawyers were Apple lawyers, I think Apple stance on privacy might be different.

Re: I've Just Liberated My Modules

#130

Post by _nfin »

callmevlad wrote: post #43

The fact that this is possible with NPM seems really dangerous. The author unpublished (erm, "liberated") over 250 NPM modules, making those global names (e.g. "map", "alert", "iframe", "subscription", etc) available for anyone to register and replace with any code they wish. Since these libs are now baked into various package.json configuration files (some with 10s of thousands of installs per month, "left-pad" with…

So we need gpg signed packages :> And... all packages should be namespaced under the author who published them. And... I kind of want to say "once it's published, it's forever".
Post reply on HN