Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I've Just Liberated My Modules

medium.com

Post reply on HN
Print view View original

361–370 of 827 posts

Re: I've Just Liberated My Modules

#361

Post by krapp »

BinaryIdiot wrote: post #318
bentlegen wrote: post #58

Earlier quoted context omitted.

Unless you're npm: https://twitter.com/seldo/status/712414400808755200

That's pretty interesting. I wonder if it's within npm's legal right to distribute someone else's IP in such a way that they do not desire. Granted the license is WTFPL but does that include taking over the IP itself?

> Granted the license is WTFPL but does that include taking over the IP itself?

IANAL but "do whatever the fuck you want to" would seem to include literally everything including taking over the IP.

Re: I've Just Liberated My Modules

#363

Post by melvinmt »

tobltobs wrote: post #242
seanp2k2 wrote: post #79

Earlier quoted context omitted.

ooh gosh, they should really do something like ban new projects from using those names until they figure out a better solution, hopefully with the module author.

Seems that we should now prefix any package name with a random string like 'skdjdihsawqy'. This way you could maybe avoid to be the target for some of those 'has to proof itself' lawyers.

Or, you know, prefix with author's username, a la Github.

Re: I've Just Liberated My Modules

#364

Post by marcuskaz »

profmonocle wrote: post #323
marcuskaz wrote: post #311

Earlier quoted context omitted.

v0.0.3 is open source, though there is no license in the Github repo, so murky, but NPM says its WTFPL Since old code is under a very permissive license, then the new owner could create v0.0.4 add code and make the new version closed with a restrictive license. This is where a license like GPL would benefit overall, since all future code requires to be under the same license. Either way, it seems like a dangerous pol…

> there is no license in the Github repo, so murky, but NPM says its WTFPL The WTFPL licensing comes from the package.json file, which is in the GitHub repo.

Yeh, my mistake. I missed it in package.json was looking for a LICENSE file.

Re: I've Just Liberated My Modules

#365

Post by d0m »

STRML wrote: post #358
d0m wrote: post #354

Earlier quoted context omitted.

Hmm, how does that help? User A: Publish package X1.0 (with 2 factor auth) User B: Download with npm package X1.0 User A: Unpublish package. User C: Publish package X1.0, malware code (with a different 2 factor auth) User B: Somewhere else, download and install package X1.0 For that to work, every package should be signed in package.js so that when you download a different version, you know about it. Also, I don't th…

When a package transfers ownership or is removed/re-added, it's not possible to republish the same version as one that has previously existed. Of course, this doesn't save you if you're installing `^1.0.0`, the maintainer deletes the package, and someone else uploads a malicous `1.0.1`. The package.json should allow pinning publisher usernames and optionally public keys, and shrinkwrap should pin hashes, not just ver…

I edited my post while you were writing yours ;-) Thanks for the clarification.

Re: I've Just Liberated My Modules

#366

Post by sotojuan »

joeandaverde wrote: post #332

Here's a highly downloaded 11 line module with lots of dependents. https://www.npmjs.com/package/escape-string-regexp I stopped searching at 1. I've certainly benefitted from the vast ecosystem of npm. I greatly appreciate the work that goes into making this ecosystem what it is. However, I think we need to be a bit more critical when it comes to acquiring dependencies. Especially authors of very prominent packages.…

Sindre basically treats npm as his snippet database. I don't see anything wrong with it.

See:

https://github.com/sindresorhus/ama/issues/10#issuecomment-1...

Re: I've Just Liberated My Modules

#367

Post by esailija »

simoncion wrote: post #309
mathetic wrote: post #116

Earlier quoted context omitted.

First, you should never have a dependency for 15 lines. Second, you sound just like people when pointed at modern art says "I could have done that" and I believe the correct response is "you didn't."

> First, you should never have a dependency for 15 lines. If those 15 lines are called throughout your codebase, you should do what? Re-write the 15 lines and stuff them into a lib that you maintain? And everyone else should do this, too? If a library is widely useful, it's widely useful regardless of how many LOC it contains.

Yes. With dependency you are giving up control and in return you save time in not having to implement the dependency. If the LoC is small you get practically nothing in return and so the only reason to do it is ideological.

Many times it is even faster to write a trivial "module" yourself than even discover it on npm, let alone reading and verifying it. Hell, NPM 3.x is so slow that it's literally faster to write any 1 liner "module" than it is just to install it.

"Reuse" is just a means to an end, it doesn't make sense to do it only for its own sake.

Re: I've Just Liberated My Modules

#368

Post by d0m »

taumeson wrote: post #190
Klathmon wrote: post #113

Earlier quoted context omitted.

A few reasons off the top of my head: * People sometimes accidentally publish bad info. Passwords, private keys, personal information, etc... being able to remove that is a big plus * if a critical security issue were found in a package, removing that version and adding a new one will practically "force" updates to happen.

that first bullet point really makes sense to me - feels like there's "no right answer" for that one. i wonder if some kind of time frame would help - one has 72 hours to unpublish, etc. thanks for answering!

Maybe one possible way to fix this problem is to let you unpublish it as long as no one else downloaded it. I.e. once I've got your security, then you're already compromised and you need to change it.

Re: I've Just Liberated My Modules

#369

Post by techdragon »

callmevlad wrote: post #173
_nfin wrote: post #130

Earlier quoted context omitted.

So we need gpg signed packages :> And... all packages should be namespaced under the author who published them. And... I kind of want to say "once it's published, it's forever".

Looks like the npm team will not be removing the ability to unpublish packages - see reply by core committer "othiym23" on https://github.com/npm/npm/pull/12017

Read the whole thread. Rather concerned by the final one. "Locking temporarily" to get away from the discussion?

That feels sort of like the online discussion equivalent of sticking your fingers in your ears and going "la la la I'm not listening".

I don't expect someone in their position to be unable to ignore a conversation and "take a break" but I would expect them to be capable of doing so without resorting to "suppressing" the ongoing group discussion.

Re: I've Just Liberated My Modules

#370

Post by ludamad »

callmevlad wrote: post #43

The fact that this is possible with NPM seems really dangerous. The author unpublished (erm, "liberated") over 250 NPM modules, making those global names (e.g. "map", "alert", "iframe", "subscription", etc) available for anyone to register and replace with any code they wish. Since these libs are now baked into various package.json configuration files (some with 10s of thousands of installs per month, "left-pad" with…

All the more reason to seek better alternatives?
Post reply on HN