I'd like to liberate your modules
The new pickup line
I've Just Liberated My Modules
241–250 of 827 posts
Re: I've Just Liberated My Modules
#242Earlier quoted context omitted.
Unless you're npm: https://twitter.com/seldo/status/712414400808755200
ooh gosh, they should really do something like ban new projects from using those names until they figure out a better solution, hopefully with the module author.
Seems that we should now prefix any package name with a random string like 'skdjdihsawqy'. This way you could maybe avoid to be the target for some of those 'has to proof itself' lawyers.
Re: I've Just Liberated My Modules
#243Earlier quoted context omitted.
Erm, that's not a very good example. You're pointing out some ancient source file from back when unix had no package management. These days echo.c is part of coreutils, a large package which is economic to manage dependencies for at scale. It's interesting to think about the distinction between promiscuous dependencies (as pioneered by Gemfile) and the Unix way. I like the latter and loathe the former, but maybe I'm…
The main point in support of your argument is the fact that Unix utils are bundled in larger packages instead of shipping in single-command packages. Think of Fileutils, Shellutils, and Textutils... which got combined to form Coreutils! Ha! That leaves only Diffutils, for the time being anyway.
But none of Fileutils, Shellutils and Textutils was ever as tiny as many npm or gem modules.
I thought how commands are bundled into packages was the entirety of what we were discussing. That was my interpretation of larkinrichards's comment (way) up above. Packages are the unit of installation, not use. Packages are all we're arguing about.
My position: don't put words in God's mouth :) The unix way is commands that do one thing and do it well. But the unix way is silent on the right way to disseminate said commands. There you're on your own.
Re: I've Just Liberated My Modules
#244Open source community needs to aggregate a list of lawyers who will consult on these sorts of things (related to the community at large) pro-bono. This way all parties on the open source side can feel a little less pushed around and bullied and a little more protected. The best part would be to learn that the claim was not valid in the first place. At the very least, having representation would provide for some wiggl…
And what if in the judicial system of the country that the programmer lives in there is a different legal situation than in the country that the Node.js Foundation (the US)? And what if there are npm mirrors in third countries where the legal situation is different in a third way?
Re: I've Just Liberated My Modules
#245I've been reading in the comments regarding 1) the practical effect of breaking builds and 2) the security issues of how package names can be reused on npm once they are unpublished (versioning aside for a moment).
I wonder what other, similar, packaging distribution platforms are vulnerable to this sort of thing? I am not speaking from knowledge of any of the procedures of any of those I'm about to mention, but I have and do depend on some them. Thinking about this issue and some of those other tools that pull long strings of dependent packages does give me pause. Especially the replacement of some dependency with less than friendly code... breakage can be managed, but silent invaders...
Does Perl & CPAN, Rust & crates.io, or Ruby & RubyGems.org suffer these same issues and it just just hasn't been a problem yet? Do they have means of avoiding this? Again, I haven't studied the question... but I think I may :-)
Re: I've Just Liberated My Modules
#246This is a really bad decision on npm's part. Kik's laywer has pulled a fast one on them. Kik has no right to enforce the Kik trademark beyond the limited set of goods and services listed in the trademark application [1]. Kik is a registered word mark for mobile messaging software only. That's why the trademark database contains many entries for just the word Kik, other companies own the use of that word for other goods and services.
I'm really surprised that npm didn't push back against this. It's not like npm isn't full of trademarks:
https://www.npmjs.com/package/pepsi
https://www.npmjs.com/package/coke
https://www.npmjs.com/package/kfc
https://www.npmjs.com/package/virgin
https://www.npmjs.com/package/sprint
https://www.npmjs.com/package/nba
https://www.npmjs.com/package/nfl
https://www.npmjs.com/package/google
https://www.npmjs.com/package/yahoo
https://www.npmjs.com/package/skype
https://www.npmjs.com/package/word
https://www.npmjs.com/package/excel
https://www.npmjs.com/package/unix
https://www.npmjs.com/package/windows
https://www.npmjs.com/package/osx
[1] http://tmsearch.uspto.gov/bin/showfield?f=doc&state=4804:lir...
Re: I've Just Liberated My Modules
#247Re: I've Just Liberated My Modules
#248FYI I'm the one who republished left-pad after it was unpublished. I think of it similar to letting a domain name expire. The original author removed the code and I forked it and published a new version with the same package name. The main issue was there were so many hard coded dependencies to 0.0.3 so I asked npm support if they could allow me to re-publish that version and they complied since I was now the maintai…
While I can appreciate the predicament this presents, do you not feel like you are going against the wishes of the original author by essentially overtaking him and publishing his code against his will?
[deleted]
Re: I've Just Liberated My Modules
#249About a year ago I tried to unpublish a version of a library I'd pushed to Elixir's hex.pm package manager but the API rejected it. Turns out they only allow you to revert publishing for an hour after you push.
It was a little inconvenient at the time but in light of this I can very clearly see the wisdom of that decision.
Re: I've Just Liberated My Modules
#250Earlier quoted context omitted.
Yes you got it right. The third point was the special exception / grey area. For the record they made sure the exact same code was published to 0.0.3 so that I didn't maliciously inject anything. I control subsequent versions though.
Now that you own it what's to stop you from pushing out a new version with a slightly reworked string pad function under a commercial license (say a $100 per use fee)? Could make quite a pretty penny. Kind of crazy that this is possible at all.
People can still just use the older versions that are immutable.