Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I've Just Liberated My Modules

medium.com

Post reply on HN
Print view View original

181–190 of 827 posts

Re: I've Just Liberated My Modules

#181

Post by profmonocle »

_nfin wrote: post #130
callmevlad wrote: post #43

The fact that this is possible with NPM seems really dangerous. The author unpublished (erm, "liberated") over 250 NPM modules, making those global names (e.g. "map", "alert", "iframe", "subscription", etc) available for anyone to register and replace with any code they wish. Since these libs are now baked into various package.json configuration files (some with 10s of thousands of installs per month, "left-pad" with…

So we need gpg signed packages :> And... all packages should be namespaced under the author who published them. And... I kind of want to say "once it's published, it's forever".

> And... I kind of want to say "once it's published, it's forever".

This is effectively the norm with more traditional, curated package managers. Say I release a piece of open source software, and some Linux distro adds it to their package manager. Under a typical open source license, I have no legal right to ask them to stop distributing it. They can just say "sorry, you licensed this code to us under X license and we're distributing it under those terms. Removing it would break our users' systems, so we won't do it."

The difference is that NPM is self-service - publishers add packages themselves, and NPM has chosen to also provide a self-service option to remove packages. I honestly wouldn't have a problem with them removing that option, and only allowing packages to be removed by contacting support with a good reason. (Accidental private info disclosure, copyright violation, severe security bug, etc.)

Re: I've Just Liberated My Modules

#182

Post by [deleted] »

stonemetal wrote: post #53
swang wrote: post #28

Was that lawyer overreaching? I don't know. But for this guy to expect npm to use their resources to defend him (which they may even possibly lose!) and get mad at them is... a bit presumptuous? Github isn't open source either so is he going to get mad when the lawyers send them an email about kik?

If the kik in question is kik.com then >Are you a developer? Kik has open-sourced tools and libraries to help you create great web experiences that can be discovered and instantly shared by Kik's 240 million users. Rather sounds like a valid use of the law, not necessarily nice but valid. They are in the same space, open source web development.

[deleted]

Re: I've Just Liberated My Modules

#183

Post by chc »

steveklabnik wrote: post #161
jsprogrammer wrote: post #159

Earlier quoted context omitted.

Sorry, but was there actually a lawsuit in this case? It sounds more like KIK emailed some people at NPM and NPM just said, "OK", then replaced a known module with some other thing. It's only a matter of time until NPM is socially engineered into replacing a module with something more malicious, if it hasn't already happened.

There was a threat of a lawsuit. npm's lawyers decided that this threat was not frivolous.

How do you know what they thought? It seems just as likely to me that they didn't see much merit in the complaint, but didn't think it was worth fighting since IP law is such a mess in the US that even clearly baseless complaints can drag on and become expensive.

Re: I've Just Liberated My Modules

#184

Post by ploxiln »

Klathmon wrote: post #93
seanp2k2 wrote: post #81

Earlier quoted context omitted.

By this logic, every Stack Overflow snippet should be a module. I'm almost hesitant to suggest this since many people who read this will be capable of building such a thing.

I'm not saying that everything should be a module, but that well designed, well tested bits of code should be modules. These 17 lines had 100% test coverage and were used by a stupidly large amount of people (read: battle tested), why not use it? As is pointed out elsewhere in this thread, echo.c is roughly the same size, does that mean it's not a worthy program?

"echo" is not versioned and delivered on its own. It's part of gnu coreutils (which contains ~ 100 utilities), or part of various BSD core distributions (more than 100 utilities, plus the kernel and libc), and also built-in to shells.

Re: I've Just Liberated My Modules

#185

Post by tantalor »

nordsieck wrote: post #157

One interesting thing to me, is that it is pretty clear that the kik lawyers pretty dramatically over enforced their trademark. For those who don't know, the purpose of trademarks is to prevent customer confusion; essentially we don't want people to be able to sell cheap knock-offs of someone else's thing without the general public being able to easily distinguish between them. In practical terms, trademarks are "sco…

They have the responsibility to defend their trademark, otherwise it could be abused by a rival claiming they did not adequately defend it. That said, NPM could have just said, "No, stop bothering us" and the lawyers might have backed down, satisfied their attempt to defend the trademark fulfilled their duty.

Re: I've Just Liberated My Modules

#186

Post by vehementi »

jlg23 wrote: post #12

Seriously? "When I started coding Kik, didn’t know there is a company with same name. And I didn’t want to let a company force me to change the name of it. After I refused them, they reached NPM’s support emphasizing their lawyer power in every single e-mail CC’ing me. I was hoping that NPM would protect me, because I always believed that NPM is a nice organization." a) Ignorance is no excuse. b) Expecting others to…

> b) Expecting others to fight for one is lame. Either have the balls and fight or STFU.

Is this a joke? In the world of hilariously over litigious rich companies crushing people with the threat of lawsuits? If you don't have the balls to defend your company vs patent trolls shut the fuck up? Hahaha.

Re: I've Just Liberated My Modules

#187

Post by PeCaN »

yeukhon wrote: post #136

If I call my module pizza, are they going to send me an email about naming it pizza? Let's think about that. If a company owns kik as a trademark, I'd offer some money to buy it off before trying to act like a tough guy. At least be soft first if your goal is get rid of kik module out there.

I don't believe pizza is trademarked or can be trademarked in any jurisdiction.

On the other hand, apparently you can name a package twitter[1] without any problems.

1. https://www.npmjs.com/package/twitter

Re: I've Just Liberated My Modules

#188

Post by chrisfosterelli »

andy9775 wrote: post #150
callmevlad wrote: post #59

Earlier quoted context omitted.

Yes, but I can publish an evil left-pad@0.0.10, and if you're not shrinkwrapping or any sub-dependency has left-pad: "^0.0.3", it will pull in the evil 0.0.10 version. EDIT: I stand corrected. See below, looks that's not the case specifically for "0.0.x" versions, but gets progressively more relaxed if there's a non-zero minor version specified. However, many of the unpublished packages had varying major and minor ve…

Wouldn't (shouldn't) npm block same named modules from being uploaded with a different username? Proposal: go with a java based naming system: com.yc.mymodule. All installations would require the user to use com.yc.* in package.json and all users would be required to register as a com.yc style organization name. Thus only one user can remove/add that exact module.

npm has namespaces, but they are optional and not hugely adopted as of yet.

Re: I've Just Liberated My Modules

#189

Post by steveklabnik »

chc wrote: post #183
steveklabnik wrote: post #161

Earlier quoted context omitted.

There was a threat of a lawsuit. npm's lawyers decided that this threat was not frivolous.

How do you know what they thought? It seems just as likely to me that they didn't see much merit in the complaint, but didn't think it was worth fighting since IP law is such a mess in the US that even clearly baseless complaints can drag on and become expensive.

Because npm stated it publicly on Twitter.

Re: I've Just Liberated My Modules

#190

Post by taumeson »

Klathmon wrote: post #113
taumeson wrote: post #99

Wow, this is an amazing outcome here. Why is "unpublishing" something that can happen in npm? What's the point? I can see the downside, what's the upside?

A few reasons off the top of my head: * People sometimes accidentally publish bad info. Passwords, private keys, personal information, etc... being able to remove that is a big plus * if a critical security issue were found in a package, removing that version and adding a new one will practically "force" updates to happen.

that first bullet point really makes sense to me - feels like there's "no right answer" for that one. i wonder if some kind of time frame would help - one has 72 hours to unpublish, etc.

thanks for answering!

Post reply on HN