I've Just Liberated My Modules • Hacker News Board

Re: I've Just Liberated My Modules

#411

Post by nchelluri » Wed, Mar 23, 2016, 5:12 AM UTC

Wow, very interesting post for me. Earlier today, at work, we ran into an issue where `npm install` was failing because the `shuffle-array` module wasn’t found. Investigation showed that the cause was that it was unpublished today. We found that this was a required dependency of the `match` module and this was in our dependency list in`package.json`.

We investigated and found out that it had been erroneously committed — it’s actually a memory game and has absolutely no place in our webservice project. :) (Mistakes happen… dependency audits can be worthwhile!)

Now, some hours later, I found your post on HackerNews and was really shocked to see, hey, this is exactly why it was unpublished. Quite a chain of events. Never thought I’d figure out why the modules were unpublished, but now I get it! Thanks for the explanation.

[crossposted from the medium article]

Re: I've Just Liberated My Modules

#412

Post by smt88 » Wed, Mar 23, 2016, 5:21 AM UTC

spinlock wrote: post #400

smt88 wrote: post #384

Earlier quoted context omitted.

As someone pointed out in another thread, you similarly couldn't name a package something like "facebook" even if Facebook had no API.

facebook may be a bad example. they named themselves after a generic directory that many colleges have been giving out for decades.

See also: YellowPages.com, Salesforce.com, etc. Just because something exists in real life (and used to describe a non-digital version of the same thing) doesn't mean it can't then be trademarked.

Re: I've Just Liberated My Modules

#413

Post by stblack » Wed, Mar 23, 2016, 5:22 AM UTC

I read the whole damn thread and nobody, nobody links to the assholes that deserve to be kik-ed.

Re: I've Just Liberated My Modules

#414

Post by swang » Wed, Mar 23, 2016, 5:24 AM UTC

spdustin wrote: post #334

alextgordon wrote: post #221

Earlier quoted context omitted.

If he wants to control where people get his software, he should have published it under a proprietary license. Not saying he does, though.

Fair enough. I would posit that he didn't ever expect that the npm folks would undo his actions, even if his decisions were/seemed rash.

He doesn't care if anyone takes over the leftpad module.

He unpublished leftpad

Someone else republishes leftpad as a new owner

Since npm won't allow you to publish old versions, stuff is still broken since the depended on files have a hard dependency on v0.0.3

npm (the company) forces a republish on v0.0.3 or I guess an ununpublish.

Re: I've Just Liberated My Modules

#415

Post by girvo » Wed, Mar 23, 2016, 5:24 AM UTC

BinaryIdiot wrote: post #318

bentlegen wrote: post #58

Earlier quoted context omitted.

Unless you're npm: https://twitter.com/seldo/status/712414400808755200

That's pretty interesting. I wonder if it's within npm's legal right to distribute someone else's IP in such a way that they do not desire. Granted the license is WTFPL but does that include taking over the IP itself?

> Granted the license is WTFPL but does that include taking over the IP itself

Well, I'm certainly not a lawyer, but I personally think thats in the spirit of the "Do What the Fuck You Want to Public License"... And at the end of the day the IP is still owned by the original author; the distribution of it has changed.

Re: I've Just Liberated My Modules

#416

Post by skeoh » Wed, Mar 23, 2016, 5:25 AM UTC

octref wrote: post #328

Why don't people just use lodash? https://lodash.com/docs#padStart It's well-tested, well-maintained, performant, with good documentation and has custom-build to leave out functions you don't need.

My project didn't 'use' left-pad -- yet it was affected by its removal. The story here is not about the specific project that was removed but that in the npm architecture it is possible for a single maintainer to negatively affect hundreds of people and projects with ease.

Re: I've Just Liberated My Modules

#417

Post by voltagex_ » Wed, Mar 23, 2016, 5:30 AM UTC

kemitchell wrote: post #398

voltagex_ wrote: post #295

Earlier quoted context omitted.

https://github.com/npm/npm/pull/12017#issuecomment-200131039 There are a lot of problems with NuGet, but they got this right. I do wish there was a way to mark a package as deprecated, though. For ages, there was an unofficial JQuery package that was years out of date.

`npm help deprecate`

Yep, unfortunately the same does not exist for NuGet.

Re: I've Just Liberated My Modules

#418

Post by [deleted] » Wed, Mar 23, 2016, 5:33 AM UTC

[deleted]

Re: I've Just Liberated My Modules

#419

Post by lucaspiller » Wed, Mar 23, 2016, 5:35 AM UTC

poooogles wrote: post #131

gariany wrote: post #80

Earlier quoted context omitted.

a) from what I understand, his project was there first. b) NPM shouldn't have to fight it unless they are requested to, the trademark claim was ridiculous to begin with. Regardless of the claim, enforcing it would have taken years... I'm not saying NPM shouldn't have comply with the request and rename the package but definitely could/should have handled this better. c) the guy wrote: "NPM is no longer a place that I’…

IANAL but looking at kiks trademark [1] I'm not so sure sadly. >Computer software for use with mobile devices, namely, computers, personal digital assistants (PDAs) and mobile phones for downloading, displaying, transmitting, receiving, editing, extracting, encoding, decoding, playing, storing and organizing text, sound, images, audio files and video files Organising text is what Kik (the project) does, so it would i…

This trademark doesn't cover the word "kik", but the whole design. They have other trademarks too, so maybe there is one that covers just the word.

Re: I've Just Liberated My Modules

#420

Post by giancarlostoro » Wed, Mar 23, 2016, 5:42 AM UTC

callmevlad wrote: post #43

The fact that this is possible with NPM seems really dangerous. The author unpublished (erm, "liberated") over 250 NPM modules, making those global names (e.g. "map", "alert", "iframe", "subscription", etc) available for anyone to register and replace with any code they wish. Since these libs are now baked into various package.json configuration files (some with 10s of thousands of installs per month, "left-pad" with…

I'm left thinking of how Go does it, whereby repositories are downloaded via git or whatever version control software's URL. Making it impossible for the admins of "NPM" to take down a package. Add in IPFS and you've got one heck of a "package manager" I guess Go's approach is not really a "package manager" but nobody can truly stop you from downloading from a git repository, and if they do, you can go to the forks etc.