Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I've Just Liberated My Modules

medium.com

Post reply on HN
Print view View original

301–310 of 827 posts

Re: I've Just Liberated My Modules

#301

Post by ch4s3 »

yazaddaruvala wrote: post #281
camwest wrote: post #232

Earlier quoted context omitted.

Well the code was open sourced. Isn't that sort of the point of open source?

Lol, so if I'm understanding you correctly: Someone was nice enough to write some software, that is clearly indispensable. They were nice enough to not charge money for it. They were nice enough to support it, again free of cost. They were also nice enough to open source it, such that if it ever became more convenient for you to fork/change/do whatever you want with, that you would be able to. And when that same pers…

Are you serious? Nice enough to yank it without giving anyone advanced warning, (likely) knowing that it would break numerous projects? My guess based on the timing of his article and his petty argument with kik, is that he intended to cause this commotion to draw attention to his complaint against kik. He could have give the community warning so that major projects could have switched over to another package. So no, I don't feel bad for the guy, I think he's being childish.

Re: I've Just Liberated My Modules

#302

Post by Klathmon »

ploxiln wrote: post #260
Klathmon wrote: post #61

Earlier quoted context omitted.

Personally i'm going to use an installable module for something even that small, because i can, and it works. The benefits from an install registry don't go away just because the module is very tiny... Why would i spend my time re-inventing the wheel for every little thing i do? And if i'm not reinventing, then i'd be copy/pasting which is much worse. At best that's a waste of time and effort to properly document the…

The overhead is in your management of your dependencies. The size of the module isn't the problem, it's the fact that you end up using so many of them (especially recursively). Consider this specific case. This author moved all their modules from one hosted location to another. Now, if you want to use these modules from that author, you need to update the scripts and configs that install them (some package.json files…

I agree that NPM needs to push namespacing much harder, as that would make the whole process much easier.

Also a "provides" field could go a long way into stopping issues like this. Allow packages to say that they provide a package in them that is compatible with another in these version ranges.

That would let "API compatible" packages be dropped in to replace even deeply nested packages easily, and would allow easy "bundling" in big libraries while still allowing easy creation and access to "micro libs".

I really believe that composing tons of small libraries is the way to go, but there needs to be better tooling to make it work. In my (admittedly not extremely expirenced) opinion, bundling many small libs into one big package to make it manageable is a symptom of a problem, not its resolution.

Re: I've Just Liberated My Modules

#303

Post by BHSPitMonkey »

guhcampos wrote: post #280

"This is not a knee-jerk action" Yes, it is. The fact you did not know about a company branded "Kik" does not make you excempt from the law. A law which, surprisingly enough, is being used in a reasonable situation here. Your package and their segment are closely enough related in context that people could assume they are actually related, giving you the power to essentially break their business if you do bad stuff.…

They are not exempt from the law, but in this case the law does not actually support Kik's exercise of trademark. NPM's staff buckled under the lawyers' threats, but had it gone to court the case would get thrown out. Kik's trademark does not cover the functionality of this project.

Re: I've Just Liberated My Modules

#304

Post by vacri »

felixrieseberg wrote: post #152
alpb wrote: post #100

Earlier quoted context omitted.

How does a 30-day notice work unless you have a way of reaching out to people using your modules? It just seemed so unrealistic that even 1% of people would actually see such a notice before things start to fall apart.

You bake deprecation notices into npm, to be displayed during install. He has more than 3m installs a month, if he really wanted to, he could have easily display a giant "npm sucks" banner during every single install. Same message, but it wouldn't immediately hurt people who trusted his modules.

Our build system eats deprecation notices with eggs for its breakfast. While I'm sure that they exist, I've never worked with a developer who paid much attention to deprecation notices unless they were looking to actively update a module.

Re: I've Just Liberated My Modules

#305

Post by heavenlyhash »

camwest wrote: post #250
tdicola wrote: post #235

Earlier quoted context omitted.

Now that you own it what's to stop you from pushing out a new version with a slightly reworked string pad function under a commercial license (say a $100 per use fee)? Could make quite a pretty penny. Kind of crazy that this is possible at all.

People can still just use the older versions that are immutable.

Except this very same string of events makes it quite obvious that versions aren't systematically immutable.

And vast numbers of people are suddenly shocked (shocked!) to realize there's no mechanical verification of stuff like this. It can all happen whimsically, and the result isn't just a loss of service, it's service with different results and no verification nor notice.

Re: I've Just Liberated My Modules

#306

Post by exception_e »

aeze wrote: post #239
overgard wrote: post #77

I think it's amusing to see this from the perspective of the company. Some guy uses your trademark without your permission so you tell him to knock it off. He refuses, so you go around him, and so he protests... by fucking over all of his users. In a dispute that doesn't involve them. And people are celebrating this.

Aren't trademarks only relevant to products or services?

This was what I was thinking while reading the post.

Also, I recently checked and https://github.com/tylertreat/comcast is still alive and well.

Re: I've Just Liberated My Modules

#307

Post by delinka »

jessaustin wrote: post #275
delinka wrote: post #202

Earlier quoted context omitted.

"Providing an interactive website featuring online non-downloadable software" indicates to me that there could indeed be confusion in a repository of software code to be used by other applications. I'd suggest it's certainly not obvious over-enforcement.

But TFA's "Kik" seems to be sort of a "project generator" like yeoman or something. There is no overlap between that and even the generously expanded description of the litigious "Kik" that you cite.

So, in your opinion, if I built a software application that let you design and order plate glass in decorative form to be placed in the walls of your house and named this app "Windows" would Microsoft's inevitable attempts at protecting their trademark be overreaching? The windows I named my app for are physical things and Microsoft's are virtual, but I'm releasing a software product called "Windows."

Both kik names exist in the realm of software. There's an argument to be made for confusion.

Re: I've Just Liberated My Modules

#308

Post by drewgross »

echelon wrote: post #279
profmonocle wrote: post #181

Earlier quoted context omitted.

> And... I kind of want to say "once it's published, it's forever". This is effectively the norm with more traditional, curated package managers. Say I release a piece of open source software, and some Linux distro adds it to their package manager. Under a typical open source license, I have no legal right to ask them to stop distributing it. They can just say "sorry, you licensed this code to us under X license and…

I honestly wouldn't have a problem with them removing that option, and only allowing packages to be removed by contacting support with a good reason. (Accidental private info disclosure, copyright violation, severe security bug, etc.) Even Rust's Cargo won't allow you to revoke secrets [1]. I think this is the correct policy. [1] http://doc.crates.io/crates-io.html#cargo-yank

Aside from secrets there is also sensitive data. If someone accidentally uploads some personal information, they need a way to remove it if, say, they receive a court order ordering them to remove it.

Re: I've Just Liberated My Modules

#309

Post by simoncion »

mathetic wrote: post #116
_wmd wrote: post #73

Earlier quoted context omitted.

Writing a 15 line function shouldn't grant someone the right to break an entire language ecosystem I think the real issue though here is technical - does npm really allow mutation of published assets like this? That's a shitty situation that can only lead to unreliable builds

First, you should never have a dependency for 15 lines. Second, you sound just like people when pointed at modern art says "I could have done that" and I believe the correct response is "you didn't."

> First, you should never have a dependency for 15 lines.

If those 15 lines are called throughout your codebase, you should do what? Re-write the 15 lines and stuff them into a lib that you maintain? And everyone else should do this, too?

If a library is widely useful, it's widely useful regardless of how many LOC it contains.

Re: I've Just Liberated My Modules

#310

Post by krainboltgreene »

kzrdude wrote: post #179
camwest wrote: post #96

FYI I'm the one who republished left-pad after it was unpublished. I think of it similar to letting a domain name expire. The original author removed the code and I forked it and published a new version with the same package name. The main issue was there were so many hard coded dependencies to 0.0.3 so I asked npm support if they could allow me to re-publish that version and they complied since I was now the maintai…

Obviously not your choice, but it's a problem of using 0.0.x versions; no flexibility for the crate author to push minor updates.

That's absolutely not true.
Post reply on HN