Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I've Just Liberated My Modules

medium.com

Post reply on HN
Print view View original

191–200 of 827 posts

Re: I've Just Liberated My Modules

#191

Post by shruubi »

camwest wrote: post #96

FYI I'm the one who republished left-pad after it was unpublished. I think of it similar to letting a domain name expire. The original author removed the code and I forked it and published a new version with the same package name. The main issue was there were so many hard coded dependencies to 0.0.3 so I asked npm support if they could allow me to re-publish that version and they complied since I was now the maintai…

While I can appreciate the predicament this presents, do you not feel like you are going against the wishes of the original author by essentially overtaking him and publishing his code against his will?

Re: I've Just Liberated My Modules

#192

Post by jahewson »

nordsieck wrote: post #157

One interesting thing to me, is that it is pretty clear that the kik lawyers pretty dramatically over enforced their trademark. For those who don't know, the purpose of trademarks is to prevent customer confusion; essentially we don't want people to be able to sell cheap knock-offs of someone else's thing without the general public being able to easily distinguish between them. In practical terms, trademarks are "sco…

Yep, I was going to say the same thing. As you say we can look up the US trademarks [1, 2] and see that this mark covers:

    Computer software for use with mobile phones and portable
    computing devices to:

    - download audio, video, digital photos and programs;

    - electronic payment systems, namely, a computer application
      software used for processing electronic payments to and
      from others;

    - computer software for use with mobile phones and portable
      computing devices to create video and digital photos to share
      with other users; computer software for use with mobile phones
      to launch other applications and connect to other software
      services.
That's it.

[1] http://tmsearch.uspto.gov/bin/showfield?f=doc&state=4804:lir...

[2] http://tmsearch.uspto.gov/bin/showfield?f=doc&state=4804:lir...

Re: I've Just Liberated My Modules

#193

Post by aidos »

nas wrote: post #155
ehsanu1 wrote: post #118

Earlier quoted context omitted.

What dependencies are required? I would have thought that for basic, no-frills use, you could just load react.js and use it with no other dependencies. Are you referring to the tooling setup required for JSX? I've never used react, just curious.

react_demo$ du -sh node_modules/ 25M node_modules/ react_demo$ ls node_modules/|wc -l 79 react_demo$ cat $(find node_modules/ -type f ) | wc -l 287767 I think I installed react, react-dom, browserify (globally), babel. The exact details are not really important, being inexperienced with react I probably installed stuff that is not strictly necessary. However, the ease of pulling in a huge amount of dependent code mak…

Have had the same experience tonight - browserify etc 12 modules, 75MB, circa 12,000 files. I guess it's just the npm way but it's definitely a bit shocking for those of us who are unfamiliar with it.

Re: I've Just Liberated My Modules

#194

Post by prodigal_erik »

dc2 wrote: post #40

> This is not a knee-jerk action. The only thing knee-jerk and honestly irresponsible is not warning anyone first, especially knowing how much his modules were depended upon. Otherwise, there's nothing wrong with this.

The whole point was demonstrating what npmjs.com has reserved the right to do to any user at any time.

Re: I've Just Liberated My Modules

#195

Post by chrisfosterelli »

Klathmon wrote: post #125
chrisfosterelli wrote: post #112

Earlier quoted context omitted.

No it won't... The caret specifier for 0.0.x packages means "this version and this version exactly ".

He's right, for `0.0.x` versions it means "this version and this version exactly" https://docs.npmjs.com/misc/semver#caret-ranges-123-025-004 And to be honest, it's news to me. Sorry i impulse downvoted you...

No problem! It's not super well-known since they switched from tildes to carets and tildes didn't behave that way.

Re: I've Just Liberated My Modules

#196

Post by Sanddancer »

cballard wrote: post #141
Sanddancer wrote: post #132

Earlier quoted context omitted.

Which is useful for binaries. Libraries, there tends to be a lot more aggregation. If this wasn't the case, you'd see libc spread over dozens and dozens of libraries like libmalloc librandom libstring libarithmetic libsocket libprocess libfilesystem libafilesystem (hey, async ops have a different api) libtime, etc.

Why would this be a bad thing? I don't need a random number generator if I just want to allocate memory.

Because a lot of little libraries makes namespaces more complicated, makes security auditing more difficult, makes troubleshooting more difficult as you have to start digging through compatibility of a ton more libraries, makes loading slower, because you have to fopen() a ton more files and parse their contents, etc. Add on top of that those little libraries needing other, probably redundant little libraries, and you can start to see how this can turn the structure of your code into mush really quickly.

At this point, optimizing runtimes to only include necessary functions, and optimizing files to only include necessary functions are both things that are pretty much a solved problem. For example, azer has a random-color library, and an rng library. Having both of those as azer-random or something means that someone automatically gets all the dependencies, without having to make many requests to the server. This makes build times shorter and a lot easier.

Sometimes, in order to best optimize for small, you have to have some parts that are big. Libraries tend to be one of those things where a few good, big libraries lead to a smaller footprint than many tiny libraries.

Re: I've Just Liberated My Modules

#197

Post by steveklabnik »

hyperpape wrote: post #164
steveklabnik wrote: post #87

Earlier quoted context omitted.

> the trademark claim was ridiculous to begin with. npm's lawyers disagree with you, and they're lawyers. EDIT: cool HN, -2 for stating a fact. Sure, I don't disagree that this lawsuit is kind of silly, but npm's laywers don't think this suit is _frivolous_, which is what matters.

Given what I know about your politics and philosophy, I find it pretty funny that I have to say this: 1) As "just a fact" it's irrelevant. With some interpretation added, it contributed something. However... 2) As participants in a market economy, the lawyers' primary interest may not be the letter of the law or what is theoretically winnable in court, but what will give npm the least hassle. I'm not sure if that's t…

My point is mostly that often, when it comes to law, lay-people talk about what they _wish_ the law was, rather than what the law actually is. And yeah, lawyers can be wrong too. But sometimes, things that seem common-sense aren't actually legally correct, and this is one of those cases. It does feel silly that a messaging company can threaten to sue over an unrelated software package, but that's just part of how intellectual property law works.

Re: I've Just Liberated My Modules

#198

Post by slavik81 »

aidos wrote: post #29
chvid wrote: post #6

In case anyone is wondering what was in the now broken dependency - here is the source code in full: module.exports = leftpad; function leftpad (str, len, ch) { str = String(str); var i = -1; if (!ch && ch !== 0) ch = ' '; len = len - str.length; while (++i https://github.com/azer/left-pad/blob/master/index.js

I'm using npm / browserify etc in anger for the first time today. This is a horrible issue to have run into and it's left a pretty sour taste. The fact that it's possible for someone to unpublish 17 lines of js and break the install of major bits of infrastructure for everybody is pretty insane. It seems like at a minimum the dependency tree should be traversed to see what the flow on effect will be. Should it even b…

> These few lines of js cost me a couple of hours tonight! :-/

Every dependency has some costs and some risks stemming from the need to trust in another person. If you're only using 17 lines of code, those costs dwarf the cost of code maintenance.

Though, there are probably ways to improve the package system such that less trust is necessary. Or even just ways to use the existing system better.

Re: I've Just Liberated My Modules

#199

Post by iancarroll »

tantalor wrote: post #185
nordsieck wrote: post #157

One interesting thing to me, is that it is pretty clear that the kik lawyers pretty dramatically over enforced their trademark. For those who don't know, the purpose of trademarks is to prevent customer confusion; essentially we don't want people to be able to sell cheap knock-offs of someone else's thing without the general public being able to easily distinguish between them. In practical terms, trademarks are "sco…

They have the responsibility to defend their trademark, otherwise it could be abused by a rival claiming they did not adequately defend it. That said, NPM could have just said, "No, stop bothering us" and the lawyers might have backed down, satisfied their attempt to defend the trademark fulfilled their duty.

You do not have to defend your trademark against people who are not infringing it. You can only infringe a trademark when you use the mark in the same context it's registered in.

IANAL.

Re: I've Just Liberated My Modules

#200

Post by smaddox »

cookrn wrote: post #169
_nfin wrote: post #130

Earlier quoted context omitted.

So we need gpg signed packages :> And... all packages should be namespaced under the author who published them. And... I kind of want to say "once it's published, it's forever".

What if such a system was implemented using IPFS[0] (or similar) for storage? [0] https://github.com/ipfs/ipfs

I'm surprised all package managers don't use an IPFS-like system that uses immutable state with mutable labels and namespaces. Now that IPFS exists, and provides distributed hosting, it's even easier.
Post reply on HN