Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I've Just Liberated My Modules

medium.com

Post reply on HN
Print view View original

231–240 of 827 posts

Re: I've Just Liberated My Modules

#231

Post by wolfgke »

felixrieseberg wrote: post #152
alpb wrote: post #100

Earlier quoted context omitted.

How does a 30-day notice work unless you have a way of reaching out to people using your modules? It just seemed so unrealistic that even 1% of people would actually see such a notice before things start to fall apart.

You bake deprecation notices into npm, to be displayed during install. He has more than 3m installs a month, if he really wanted to, he could have easily display a giant "npm sucks" banner during every single install. Same message, but it wouldn't immediately hurt people who trusted his modules.

> Same message, but it wouldn't immediately hurt people who trusted his modules.

Perhaps he wanted (because of his rage on npm) to hurt people that trust(ed) npm?

Re: I've Just Liberated My Modules

#232

Post by camwest »

shruubi wrote: post #191
camwest wrote: post #96

FYI I'm the one who republished left-pad after it was unpublished. I think of it similar to letting a domain name expire. The original author removed the code and I forked it and published a new version with the same package name. The main issue was there were so many hard coded dependencies to 0.0.3 so I asked npm support if they could allow me to re-publish that version and they complied since I was now the maintai…

While I can appreciate the predicament this presents, do you not feel like you are going against the wishes of the original author by essentially overtaking him and publishing his code against his will?

Well the code was open sourced. Isn't that sort of the point of open source?

Re: I've Just Liberated My Modules

#233

Post by overgard »

phn wrote: post #137
overgard wrote: post #77

I think it's amusing to see this from the perspective of the company. Some guy uses your trademark without your permission so you tell him to knock it off. He refuses, so you go around him, and so he protests... by fucking over all of his users. In a dispute that doesn't involve them. And people are celebrating this.

Bleh, involving brand names or trademarks or whatever on a library that doesn't even seem to be commercial is a pretty dick move to begin with. And his protest is against npm, who allowed someone to appropriate his work. The users are collateral damage, but really, can you blame the guy? Given the circumstances, urging users to ditch npm isn't a bad idea.

The thing about trademarks is if you fail to defend them, they can be considered "weak" and you can lose your rights to it. If you have a trademark and it's important to you, it's in your best interest to defend it so you don't lose it. It doesn't matter if it's a "dick" move or not, or if the infringement was non-commercial, he was messing with their trademark, and if they want to keep it they have to actively defend it.

Re: I've Just Liberated My Modules

#234

Post by [deleted] »

maxaf wrote: post #217
akkartik wrote: post #111

Earlier quoted context omitted.

Erm, that's not a very good example. You're pointing out some ancient source file from back when unix had no package management. These days echo.c is part of coreutils, a large package which is economic to manage dependencies for at scale. It's interesting to think about the distinction between promiscuous dependencies (as pioneered by Gemfile) and the Unix way. I like the latter and loathe the former, but maybe I'm…

The main point in support of your argument is the fact that Unix utils are bundled in larger packages instead of shipping in single-command packages. Think of Fileutils, Shellutils, and Textutils... which got combined to form Coreutils! Ha! That leaves only Diffutils, for the time being anyway.

[deleted]

Re: I've Just Liberated My Modules

#235

Post by tdicola »

camwest wrote: post #230
ploxiln wrote: post #209

Earlier quoted context omitted.

So if I understand correctly * npm allows a module to be deleted so all fetches of published name-oldversion fail * npm allows you to take-over the name of a deleted module and publish name-newversion * npm does not allow you to "re-publish" name-oldversion which had existed before the deletion but npm ops forced this publish for your special case That's a strange combination of constraints. If you're going to reserv…

Yes you got it right. The third point was the special exception / grey area. For the record they made sure the exact same code was published to 0.0.3 so that I didn't maliciously inject anything. I control subsequent versions though.

Now that you own it what's to stop you from pushing out a new version with a slightly reworked string pad function under a commercial license (say a $100 per use fee)? Could make quite a pretty penny. Kind of crazy that this is possible at all.

Re: I've Just Liberated My Modules

#236

Post by wolfgke »

steveklabnik wrote: post #197
hyperpape wrote: post #164

Earlier quoted context omitted.

Given what I know about your politics and philosophy, I find it pretty funny that I have to say this: 1) As "just a fact" it's irrelevant. With some interpretation added, it contributed something. However... 2) As participants in a market economy, the lawyers' primary interest may not be the letter of the law or what is theoretically winnable in court, but what will give npm the least hassle. I'm not sure if that's t…

My point is mostly that often, when it comes to law, lay-people talk about what they _wish_ the law was, rather than what the law actually is. And yeah, lawyers can be wrong too. But sometimes, things that seem common-sense aren't actually legally correct, and this is one of those cases. It does feel silly that a messaging company can threaten to sue over an unrelated software package, but that's just part of how int…

> My point is mostly that often, when it comes to law, lay-people talk about what they _wish_ the law was, rather than what the law actually is.

That is why the law should be formalized such that correctness proofs for argumentations can be given and in doubt even be checked independently by a computer. Exactly because of the possibility of different opinions and wishes, coming up with such a high standard should be considered a maxim.

Re: I've Just Liberated My Modules

#238

Post by kennywinker »

PeCaN wrote: post #187
yeukhon wrote: post #136

If I call my module pizza, are they going to send me an email about naming it pizza? Let's think about that. If a company owns kik as a trademark, I'd offer some money to buy it off before trying to act like a tough guy. At least be soft first if your goal is get rid of kik module out there.

I don't believe pizza is trademarked or can be trademarked in any jurisdiction. On the other hand, apparently you can name a package twitter[1] without any problems. 1. https://www.npmjs.com/package/twitter

All of this is dependant on complaints. Certainly Twitter the company could come after and get twitter the module taken down. They have enough twitter related products that overlap conceptually with an NPM module. They've seen no need to up to this point. That doesn't mean they aren't theoretically violating the trademark...

Re: I've Just Liberated My Modules

#239

Post by aeze »

overgard wrote: post #77

I think it's amusing to see this from the perspective of the company. Some guy uses your trademark without your permission so you tell him to knock it off. He refuses, so you go around him, and so he protests... by fucking over all of his users. In a dispute that doesn't involve them. And people are celebrating this.

Aren't trademarks only relevant to products or services?

Re: I've Just Liberated My Modules

#240

Post by overgard »

wyuenho wrote: post #108
overgard wrote: post #77

I think it's amusing to see this from the perspective of the company. Some guy uses your trademark without your permission so you tell him to knock it off. He refuses, so you go around him, and so he protests... by fucking over all of his users. In a dispute that doesn't involve them. And people are celebrating this.

I for one wholeheartedly support him. The more collateral damage he causes, the more people are awareness he raises. While the solution to his problem is unclear at this point, it'll at least get us talking, and find out what all of the stakeholders can do better next time, and we as a community to prevent this from ever happening again. I entirely supports his actions.

"awareness". Awareness of what? His trademark infringement?

Imagine this from the perspective of a hypothetical user. He's cranky and on a tight deadline, and suddenly his project is broken because some dumb dependency three layers away that he's never even heard of broke because some guy decided to throw a tantrum, and now his software is broken and he has to emergency rewrite part of it. All because this guy didn't bother to check if "kik" was a name he was allowed to use.

Post reply on HN