Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I've Just Liberated My Modules

medium.com

Post reply on HN
Print view View original

311–320 of 827 posts

Re: I've Just Liberated My Modules

#311

Post by marcuskaz »

ricardobeat wrote: post #255
tdicola wrote: post #235

Earlier quoted context omitted.

Now that you own it what's to stop you from pushing out a new version with a slightly reworked string pad function under a commercial license (say a $100 per use fee)? Could make quite a pretty penny. Kind of crazy that this is possible at all.

Why on earth would someone pay for that if the code is already open source?

v0.0.3 is open source, though there is no license in the Github repo, so murky, but NPM says its WTFPL

Since old code is under a very permissive license, then the new owner could create v0.0.4 add code and make the new version closed with a restrictive license.

This is where a license like GPL would benefit overall, since all future code requires to be under the same license.

Either way, it seems like a dangerous policy to allow someone to re-own a previous owned and published module. Licensing is not the real threat but malicious code that potentially could be deployed.

Re: I've Just Liberated My Modules

#312

Post by yazaddaruvala »

ch4s3 wrote: post #301
yazaddaruvala wrote: post #281

Earlier quoted context omitted.

Lol, so if I'm understanding you correctly: Someone was nice enough to write some software, that is clearly indispensable. They were nice enough to not charge money for it. They were nice enough to support it, again free of cost. They were also nice enough to open source it, such that if it ever became more convenient for you to fork/change/do whatever you want with, that you would be able to. And when that same pers…

Are you serious? Nice enough to yank it without giving anyone advanced warning, (likely) knowing that it would break numerous projects? My guess based on the timing of his article and his petty argument with kik, is that he intended to cause this commotion to draw attention to his complaint against kik. He could have give the community warning so that major projects could have switched over to another package. So no,…

To be honest,

I really don't care either way about this situation.

I truly find humor/curiosity in the attitude of the grand parent.

Re: I've Just Liberated My Modules

#313

Post by fungi »

bluefox wrote: post #214
guelo wrote: post #126

Earlier quoted context omitted.

So left-pad is too important to be removed but Kik isn't? What if the author had originally called left-pad Kik? Why is it ok for the Kik trademark holder to break thousands of builds but not the module author?

This is a very good question. I was going to make the argument that the author merely continued what NPM Inc. started, and that if you fault him, you should also fault NPM Inc., but then I noticed that NPM Inc. didn't unpublish his module, but transfered the name to another account, which is much worse, if you think about it. The ultimate conclusion is that if it's anyone's fault, it is the fault of the person who re…

couple of days ago i was all smug from upvotes for calling npm best practise.

i take that back, npm is a security risk that should be avoided.

now i need a new package manager.

Re: I've Just Liberated My Modules

#314

Post by vacri »

Klathmon wrote: post #93
seanp2k2 wrote: post #81

Earlier quoted context omitted.

By this logic, every Stack Overflow snippet should be a module. I'm almost hesitant to suggest this since many people who read this will be capable of building such a thing.

I'm not saying that everything should be a module, but that well designed, well tested bits of code should be modules. These 17 lines had 100% test coverage and were used by a stupidly large amount of people (read: battle tested), why not use it? As is pointed out elsewhere in this thread, echo.c is roughly the same size, does that mean it's not a worthy program?

Why not just put it into the core? Why should it even be a module at this point?

Re: I've Just Liberated My Modules

#315

Post by jessaustin »

delinka wrote: post #307
jessaustin wrote: post #275

Earlier quoted context omitted.

But TFA's "Kik" seems to be sort of a "project generator" like yeoman or something. There is no overlap between that and even the generously expanded description of the litigious "Kik" that you cite.

So, in your opinion, if I built a software application that let you design and order plate glass in decorative form to be placed in the walls of your house and named this app "Windows" would Microsoft's inevitable attempts at protecting their trademark be overreaching? The windows I named my app for are physical things and Microsoft's are virtual, but I'm releasing a software product called "Windows." Both kik names…

Yes, even this faintly ridiculous fake example of painstaking mental construction would be overreach. No one would ever download your hypothetical architectural software expecting to get an operating system.

As a public service, some toilet or compost bin manufacturer ought to start "violating" trademarks by naming toilets etc. after litigious companies. We'd all get a kik out of hearing them argue that database consumers are likely to confuse the Oracle database with the Oracle water closet. [EDIT: "Sure it's a CRUD app, but I'm more interested in Deletion than Retrieval!"]

Of course there are arguments to be made; lawyers are involved.

Re: I've Just Liberated My Modules

#316

Post by badusername »

spriggan3 wrote: post #156
mschuster91 wrote: post #55

brouhaha, this is why you should not put node_modules into .gitignore (same for PHP's composer.lock and vendor/ folder). To be honest, I have waited for something like this to happen so that people finally wake up and realize how deeply and truly compromised the JS ecosystem really is. 11 SLOC not available any more and all over the internet builds are breaking etc.?! And please, why isn't essential stuff like this i…

> brouhaha, this is why you should not put node_modules into .gitignore (same for PHP's composer.lock and vendor/ folder). You should obviously not do that if you are writing a library. You shouldn't publish vendored modules on npm. If everybody did this everybody would end up fetching 100MB packages.

Not adding node_modules to .gitignore would be a very wrong way of solving this issue.

Re: I've Just Liberated My Modules

#317

Post by Klathmon »

vacri wrote: post #314
Klathmon wrote: post #93

Earlier quoted context omitted.

I'm not saying that everything should be a module, but that well designed, well tested bits of code should be modules. These 17 lines had 100% test coverage and were used by a stupidly large amount of people (read: battle tested), why not use it? As is pointed out elsewhere in this thread, echo.c is roughly the same size, does that mean it's not a worthy program?

Why not just put it into the core? Why should it even be a module at this point?

Because in JavaScript there are many different implementations of engines, and they run on all kinds of stuff. Adding something to the standard is not a small task, and it means that it's now extra code that needs to be installed on practically every single PC.

And that doesn't remove the need for a library like this (or your own implementation) for a long time because you can't rely on a brand new release to be available for everyone.

Re: I've Just Liberated My Modules

#318

Post by BinaryIdiot »

bentlegen wrote: post #58
krainboltgreene wrote: post #50

Earlier quoted context omitted.

That's not how it works. You can't publish left-pad 0.0.3 again.

Unless you're npm: https://twitter.com/seldo/status/712414400808755200

That's pretty interesting. I wonder if it's within npm's legal right to distribute someone else's IP in such a way that they do not desire. Granted the license is WTFPL but does that include taking over the IP itself?

Re: I've Just Liberated My Modules

#320

Post by gbaygon »

overgard wrote: post #298
jonahx wrote: post #106

Earlier quoted context omitted.

This seems like a serious security risk. Is there any solution? Would using version numbers without the caret work?

Not only is there a solution, but it's pretty well known computer science. Use public key cryptography to create a digital signature. It's not even a novel use of this -- .NET has been using this to sign assemblies and packages from day one.

I think he means a solution to the current problem of the packages being replaced with malicious ones, not the problem with npm not supporting package signatures.
Post reply on HN