Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I've Just Liberated My Modules

medium.com

Post reply on HN
Print view View original

151–160 of 827 posts

Re: I've Just Liberated My Modules

#151

Post by kelnos »

_puk wrote: post #107
profmonocle wrote: post #44

Earlier quoted context omitted.

Did they? Most open source licenses aren't revokable - you don't have to stop distributing the code just because the author asks you to stop. That seems especially true in this case, considering the author chose[1] to license left-pad under the WTFPL[2]. I'd say re-publishing the package counts as NPM doing "whatever the f * they want" with the code. [1] https://github.com/azer/left-pad/blob/master/package.json [2] h…

Presumably, if the original author had changed the licence and pushed to npm prior to change of ownership then npm wouldn't have been able to do this? Sounds like we could start seeing npm specific releases with different licences to the github repo (or npm specific branches with different licencing) Obviously npm could re-publish the non npm specific code, but that would be more manual than a simple revert of an unp…

You can't retroactively change license. Sure, the author could push a new version with a new license, but the old versions would still be governed by the old license.

Re: I've Just Liberated My Modules

#152

Post by felixrieseberg »

alpb wrote: post #100
felixrieseberg wrote: post #21

Azer has contributed awesome modules to the community, but such a move _obviously_ messes with a bunch of people who previously didn't trust npm, but Azer. Npm works fine. There might be issues with it, but the reason builds are failing right now is that he decided to unpublish all of them - in a move that feels very kneejerky, despite him claiming that it's the opposite. If this had been actually in the interest of…

How does a 30-day notice work unless you have a way of reaching out to people using your modules? It just seemed so unrealistic that even 1% of people would actually see such a notice before things start to fall apart.

You bake deprecation notices into npm, to be displayed during install. He has more than 3m installs a month, if he really wanted to, he could have easily display a giant "npm sucks" banner during every single install. Same message, but it wouldn't immediately hurt people who trusted his modules.

Re: I've Just Liberated My Modules

#153

Post by spdustin »

swang wrote: post #70
spdustin wrote: post #38

Earlier quoted context omitted.

This feels very wrong to me. I know, open source, etc., and it's likely that the source license allows it provided the license remain intact, but still... For better or worse (worse, IMHO), the author decided to un-publish his nam modules. He asserted his authority over that package of his code. For npm to usurp his authority, even if the licensing allows it, feels wrong .

Nope, nothing wrong. The code he wrote is his, but he doesn't own the npm namespace, which is all anyone cares about here at this point. But you know what also _feels_ wrong? people who had no involvement in this at all having their day get fucked up because of this one dude who _suddenly_, just now realized that npm isn't going to really help him out and did the internet equivalent of taking your ball and going home…

Agreed, that feels wrong too. But is npm supposed to be the recess supervisor in this metaphor, taking the ball back and giving it back to the other kids?

Re: I've Just Liberated My Modules

#155

Post by nas »

ehsanu1 wrote: post #118
nas wrote: post #66

Earlier quoted context omitted.

I don't want to sound like a old grumpy man but here goes anyhow. I was looking into using node.js, react, etc after many years of writing web apps using Python and Quixote (obscure web framework like Flask). The whole Javascript technology stack looks pretty insane of me. Getting a working React environment requires a huge number of packages to be pulled down by npm. Browserify requires a bunch more. Recursive depen…

What dependencies are required? I would have thought that for basic, no-frills use, you could just load react.js and use it with no other dependencies. Are you referring to the tooling setup required for JSX? I've never used react, just curious.

    react_demo$ du -sh node_modules/
    25M     node_modules/
    react_demo$ ls node_modules/|wc -l
    79
    react_demo$ cat $(find node_modules/ -type f ) | wc -l
    287767
I think I installed react, react-dom, browserify (globally), babel. The exact details are not really important, being inexperienced with react I probably installed stuff that is not strictly necessary. However, the ease of pulling in a huge amount of dependent code makes me concerned. For a long lived stable application you will have to maintain those dependencies (at a minimum, have 3rd party maintainers who you can trust to maintain it, not break your app, not inject security issues into your app, etc).

Re: I've Just Liberated My Modules

#156

Post by spriggan3 »

mschuster91 wrote: post #55

brouhaha, this is why you should not put node_modules into .gitignore (same for PHP's composer.lock and vendor/ folder). To be honest, I have waited for something like this to happen so that people finally wake up and realize how deeply and truly compromised the JS ecosystem really is. 11 SLOC not available any more and all over the internet builds are breaking etc.?! And please, why isn't essential stuff like this i…

> brouhaha, this is why you should not put node_modules into .gitignore (same for PHP's composer.lock and vendor/ folder).

You should obviously not do that if you are writing a library. You shouldn't publish vendored modules on npm. If everybody did this everybody would end up fetching 100MB packages.

Re: I've Just Liberated My Modules

#157

Post by nordsieck »

One interesting thing to me, is that it is pretty clear that the kik lawyers pretty dramatically over enforced their trademark.

For those who don't know, the purpose of trademarks is to prevent customer confusion; essentially we don't want people to be able to sell cheap knock-offs of someone else's thing without the general public being able to easily distinguish between them. In practical terms, trademarks are "scoped" by their "goods and services" declarations.

For example, Apple the device manufacture[1] and Apple the record label[2] could both be trademarked because they had non-overlapping goods and services declarations... until iTunes started selling music[3].

If you look at kik's trademark application[4], you can clearly see that the trademark is limited to chat/media consumer applications, a pretty obvious over enforcement.

[1] http://apple.com

[2] http://applerecords.com

[3] https://en.wikipedia.org/wiki/Apple_Corps_v_Apple_Computer

[4] https://trademarks.justia.com/858/93/kik-85893307.html

Re: I've Just Liberated My Modules

#158

Post by chc »

overgard wrote: post #77

I think it's amusing to see this from the perspective of the company. Some guy uses your trademark without your permission so you tell him to knock it off. He refuses, so you go around him, and so he protests... by fucking over all of his users. In a dispute that doesn't involve them. And people are celebrating this.

You missed part of the story. From the article, it sounds like npm decided to play the "We're a private company" card and was threatening to take control away from him, so he decided to disassociate himself from them. And because of the way npm's system works, this broke other packages and the new maintainers had difficulty fixing the problems.

Re: I've Just Liberated My Modules

#159

Post by jsprogrammer »

steveklabnik wrote: post #87
gariany wrote: post #80

Earlier quoted context omitted.

a) from what I understand, his project was there first. b) NPM shouldn't have to fight it unless they are requested to, the trademark claim was ridiculous to begin with. Regardless of the claim, enforcing it would have taken years... I'm not saying NPM shouldn't have comply with the request and rename the package but definitely could/should have handled this better. c) the guy wrote: "NPM is no longer a place that I’…

> the trademark claim was ridiculous to begin with. npm's lawyers disagree with you, and they're lawyers. EDIT: cool HN, -2 for stating a fact. Sure, I don't disagree that this lawsuit is kind of silly, but npm's laywers don't think this suit is _frivolous_, which is what matters.

Sorry, but was there actually a lawsuit in this case? It sounds more like KIK emailed some people at NPM and NPM just said, "OK", then replaced a known module with some other thing.

It's only a matter of time until NPM is socially engineered into replacing a module with something more malicious, if it hasn't already happened.

Re: I've Just Liberated My Modules

#160

Post by spriggan3 »

vulpes wrote: post #115

Here's [1] a list of all modules that were liberated. Some serious land-grab opportunities there [1]: https://gist.github.com/azer/db27417ee84b5f34a6ea

> Some serious land-grab opportunities there

It sums up the biggest issue with npm. Modules shouldn't be a name but a namespace + a name , just like composer. Someone shouldn't be able to have a monopoly on names like "web" or "async". It should be "some-namespace/module-name".

Post reply on HN