Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I've Just Liberated My Modules

medium.com

Post reply on HN
Print view View original

131–140 of 827 posts

Re: I've Just Liberated My Modules

#131

Post by poooogles »

gariany wrote: post #80
x0ner wrote: post #17

Not sure I follow this completely... You start a project with the same name as a company, which owns the registered brand and are surprised when some 3rd party complies with legal suggestions to make an adjustment? Seems kind of silly to expect that NPM would want to fight for your project name when you didn't seem to do your own due diligence when picking a name. Also, a bit backwards to go remove all your modules a…

a) from what I understand, his project was there first. b) NPM shouldn't have to fight it unless they are requested to, the trademark claim was ridiculous to begin with. Regardless of the claim, enforcing it would have taken years... I'm not saying NPM shouldn't have comply with the request and rename the package but definitely could/should have handled this better. c) the guy wrote: "NPM is no longer a place that I’…

IANAL but looking at kiks trademark [1] I'm not so sure sadly.

>Computer software for use with mobile devices, namely, computers, personal digital assistants (PDAs) and mobile phones for downloading, displaying, transmitting, receiving, editing, extracting, encoding, decoding, playing, storing and organizing text, sound, images, audio files and video files

Organising text is what Kik (the project) does, so it would infringe the trademark?

1 - https://trademarks.justia.com/858/93/kik-85893307.html

Re: I've Just Liberated My Modules

#132

Post by Sanddancer »

joshmanders wrote: post #45
larkinrichards wrote: post #31

I applaud this action and while I'd like to point the finger at NPM, there's no real other method to fix historical package versions that depend on this. It is worth pointing to the silly state of NPM packages: Who decided that an external dependency was necessary for a module that is 17 lines of code? module.exports = leftpad; function leftpad (str, len, ch) { str = String(str); var i = -1; if (!ch && ch !== 0) ch =…

https://en.wikipedia.org/wiki/Unix_philosophy

Which is useful for binaries. Libraries, there tends to be a lot more aggregation. If this wasn't the case, you'd see libc spread over dozens and dozens of libraries like libmalloc librandom libstring libarithmetic libsocket libprocess libfilesystem libafilesystem (hey, async ops have a different api) libtime, etc.

Re: I've Just Liberated My Modules

#133

Post by jsprogrammer »

zippergz wrote: post #75
jsprogrammer wrote: post #39

Earlier quoted context omitted.

There are no legal claims to be made over NPM package names. NPM has a policy for assigning names and third party attorneys don't get a say. Are you serious? >Seriously

What is the legal basis for the claim that NPM package names are somehow exempt from trademark and other law?

NPM does not offer packages as commerce. The package removed was not used in commerce. The KIK trademark does not claim any functionality related to the removed module.

What legal basis is there that NPM packages are subject to trademark, or other law?

NPM takes its names from the package.json file. The law has no say over what one may put into their package.json file.

Re: I've Just Liberated My Modules

#134

Post by aidos »

kasey_junk wrote: post #68
aidos wrote: post #32

Earlier quoted context omitted.

Then how can you ever install anything in the first place?

Having no understanding of the broader js context I assumed the comment to mean "all library dependencies should be checked in, build tools should be defined & specified & able to fully recreate the build given they are installed". For the record this is a well known & frequently advocated for build pattern.

Fair enough, I guess I was just thinking of the issue I'd run into with trying to actually install anything in the first place.

In the case of npm though, installation brings down a lot of files so it's not super efficient. I've installed 15 packages and have over 12,000 files (75MB) to show for it.

Re: I've Just Liberated My Modules

#135

Post by Karunamon »

Etheryte wrote: post #57
mathetic wrote: post #30

Earlier quoted context omitted.

This is incredible. They screwed the author about ownership once and then they did exactly the same thing again.

Yes, I was rather neutral at first, but this is a complete dick move on NPM's behalf. Essentially they've just given the module to another owner.

I can't agree. The author licensed the code under WTFPL, meaning he directly authorized anyone to do whatever with it in pretty much the most explicit and unambiguous terms possible.

Here's the WTFPL in it's entirety:

   0. You just DO WHAT THE FUCK YOU WANT

Re: I've Just Liberated My Modules

#136

Post by yeukhon »

If I call my module pizza, are they going to send me an email about naming it pizza? Let's think about that. If a company owns kik as a trademark, I'd offer some money to buy it off before trying to act like a tough guy. At least be soft first if your goal is get rid of kik module out there.

Re: I've Just Liberated My Modules

#137

Post by phn »

overgard wrote: post #77

I think it's amusing to see this from the perspective of the company. Some guy uses your trademark without your permission so you tell him to knock it off. He refuses, so you go around him, and so he protests... by fucking over all of his users. In a dispute that doesn't involve them. And people are celebrating this.

Bleh, involving brand names or trademarks or whatever on a library that doesn't even seem to be commercial is a pretty dick move to begin with.

And his protest is against npm, who allowed someone to appropriate his work. The users are collateral damage, but really, can you blame the guy? Given the circumstances, urging users to ditch npm isn't a bad idea.

Re: I've Just Liberated My Modules

#138

Post by aioprisan »

chc wrote: post #117
aioprisan wrote: post #104

If NPM wants to stay relevant and a serious contender, they need to have more clear policies in case of IP issues. In this case, the companies weren't even in the same space. Republishing someone's package who has chosen to unpublish and leave your platform is akin to Facebook resurrecting a Facebook profile because they had a lot of friends and the social circle ripple effects would be too high for feed quality for…

As best I can tell, before NPM restored it, Azer had transferred ownership to somebody else, who wanted to republish the old version but couldn't. So they do appear to be respecting the maintainer's wishes.

That's not how the dependencies in npm work, for most who explicitly replied on owner/project-name notation. Even worse, when unpublished, someone (i.e. malicious actor) could have registered a global name for this or one of many hundreds of packages he wrote, and inject malicious code in all projects from babel to react to my side projects. NPM really got caught with their pants down on this one, and veered into the wrong by opting to unbreak tens of thousands of packages vs. doing the right thing.

Re: I've Just Liberated My Modules

#139

Post by jsprogrammer »

profmonocle wrote: post #84
jsprogrammer wrote: post #39

Earlier quoted context omitted.

There are no legal claims to be made over NPM package names. NPM has a policy for assigning names and third party attorneys don't get a say. Are you serious? >Seriously

> There are no legal claims to be made over NPM package names. Why not? An NPM package name is the name of a piece of software, and software names are very much covered under trademark law.

An NPM package name is just what NPM scraped from a package.json file.

Re: I've Just Liberated My Modules

#140

Post by zanny »

aioprisan wrote: post #104

If NPM wants to stay relevant and a serious contender, they need to have more clear policies in case of IP issues. In this case, the companies weren't even in the same space. Republishing someone's package who has chosen to unpublish and leave your platform is akin to Facebook resurrecting a Facebook profile because they had a lot of friends and the social circle ripple effects would be too high for feed quality for…

> We need an open source NPM alternative, yesterday.

NPM is open source.[1] You don't want an open source NPM, you want a distributed consensus NPM where nobody has absolute power to censor or destroy other peoples work.

It seems like a prime use case for a DHT, possibly with some blockchain functionality identifying ownership of namespaces that people can reserve, like namecoin.

[1]: https://github.com/npm/npm

Post reply on HN