Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I've Just Liberated My Modules

medium.com

Post reply on HN
Print view View original

451–460 of 827 posts

Re: I've Just Liberated My Modules

#451

Post by jhall1468 »

overgard wrote: post #409
aioprisan wrote: post #86

Earlier quoted context omitted.

Is that really silly? Coming up with a project name in an unrelated project in the technology space? That's akin to Ajax Detergent ( https://en.wikipedia.org/wiki/Ajax_(cleaning_product) ) wanting all jQuery wiped off because there is a $.ajax() function in jQuery. Look, it even has a $! Chaching with every occurrence!

It's not an unrelated technology space! Kik is a messaging platform. It's EASILY conceivable that they might want to publish a nodejs API. It's also easily conceivable someone looking to interact with their platform would type npm install kik. They're entirely in their rights to see this as stepping on their turf.

That. Is. Not. How. Trademarks. Work.

A trademark gives you protection of a mark within a specific industry. "Software" is not a specific industry. They do not get wholesale ownership of the term.

And if you blindly install a module, expecting it to be some official release without looking it up, you're an idiot.

Re: I've Just Liberated My Modules

#452

Post by cyphar »

cammsaul wrote: post #172

There's a PR open to remove "unpublish" from NPM here: https://github.com/npm/npm/pull/12017

I love how it was said that something like this has "only happened 3 times in the last 2 years". The fact that it's so easy to break npm is hilarious, and of course the maintainers don't care.

Re: I've Just Liberated My Modules

#453

Post by stevebmark »

nas wrote: post #66
aidos wrote: post #29

Earlier quoted context omitted.

I'm using npm / browserify etc in anger for the first time today. This is a horrible issue to have run into and it's left a pretty sour taste. The fact that it's possible for someone to unpublish 17 lines of js and break the install of major bits of infrastructure for everybody is pretty insane. It seems like at a minimum the dependency tree should be traversed to see what the flow on effect will be. Should it even b…

I don't want to sound like a old grumpy man but here goes anyhow. I was looking into using node.js, react, etc after many years of writing web apps using Python and Quixote (obscure web framework like Flask). The whole Javascript technology stack looks pretty insane of me. Getting a working React environment requires a huge number of packages to be pulled down by npm. Browserify requires a bunch more. Recursive depen…

Javascript has an almost non-existent standard lib. Obviously Python ships with most of the kitchen sink in core. You're not grumpy, but you're misguided.

Re: I've Just Liberated My Modules

#454

Post by cyphar »

lerpa wrote: post #386
bbcbasic wrote: post #291

> This is not a knee-jerk action Seems like it. Why break everyone's builds? You could just keep the modules there and then declare you will only keep them updated elsewhere?

I think what actually is a knee jerk reaction being irresponsible with your dependencies and blame others for your lack of foresight. He doesn't owe you anything. You and other should be thankful for him to have allowed you to use his code. Fuck that entitlement bs.

Except of course that the library in question is 12 lines of code. And that you might not even know that three levels down your dependency tree someone used that module.

Re: I've Just Liberated My Modules

#455

Post by kibwen »

drewgross wrote: post #308
echelon wrote: post #279

Earlier quoted context omitted.

I honestly wouldn't have a problem with them removing that option, and only allowing packages to be removed by contacting support with a good reason. (Accidental private info disclosure, copyright violation, severe security bug, etc.) Even Rust's Cargo won't allow you to revoke secrets [1]. I think this is the correct policy. [1] http://doc.crates.io/crates-io.html#cargo-yank

Aside from secrets there is also sensitive data. If someone accidentally uploads some personal information, they need a way to remove it if, say, they receive a court order ordering them to remove it.

This why sites that don't allow package authors to "unpublish" have contact information so that data deletion can be handled on a case-by-case basis.

Re: I've Just Liberated My Modules

#457

Post by pbreit »

tantalor wrote: post #185
nordsieck wrote: post #157

One interesting thing to me, is that it is pretty clear that the kik lawyers pretty dramatically over enforced their trademark. For those who don't know, the purpose of trademarks is to prevent customer confusion; essentially we don't want people to be able to sell cheap knock-offs of someone else's thing without the general public being able to easily distinguish between them. In practical terms, trademarks are "sco…

They have the responsibility to defend their trademark, otherwise it could be abused by a rival claiming they did not adequately defend it. That said, NPM could have just said, "No, stop bothering us" and the lawyers might have backed down, satisfied their attempt to defend the trademark fulfilled their duty.

I hear this all the time but have never seen an actual example? Are there any? (Where defense was existent but perhaps incomplete, not nonexistent)

Re: I've Just Liberated My Modules

#458

Post by akx »

vacri wrote: post #304
felixrieseberg wrote: post #152

Earlier quoted context omitted.

You bake deprecation notices into npm, to be displayed during install. He has more than 3m installs a month, if he really wanted to, he could have easily display a giant "npm sucks" banner during every single install. Same message, but it wouldn't immediately hurt people who trusted his modules.

Our build system eats deprecation notices with eggs for its breakfast. While I'm sure that they exist, I've never worked with a developer who paid much attention to deprecation notices unless they were looking to actively update a module.

They'd notice it when doing a local `npm i` for development.

Re: I've Just Liberated My Modules

#459

Post by jsprogrammer »

profmonocle wrote: post #207
jsprogrammer wrote: post #133

Earlier quoted context omitted.

NPM does not offer packages as commerce. The package removed was not used in commerce. The KIK trademark does not claim any functionality related to the removed module. What legal basis is there that NPM packages are subject to trademark, or other law? NPM takes its names from the package.json file. The law has no say over what one may put into their package.json file.

Offering a product/service for free doesn't exempt it from trademark law. I couldn't make an open source word processor and call it "Microsoft Word".

The US Federal Government only has the ability to regulate interstate commerce. Kik, the project, does not engage in commerce. Also, npm (the package manager) is not a commercial vehicle.

>I couldn't make an open source word processor and call it "Microsoft Word".

Sure you could, you just couldn't use it in commerce.

Re: I've Just Liberated My Modules

#460

Post by minitech »

skeoh wrote: post #407
minitech wrote: post #339

Earlier quoted context omitted.

Hah, “indispensable”. It pads strings. Here, I wrote an alternative: function padLeft(s, width, padCharacter) { var d = width - s.length; return d

Keep in mind that `String.prototype.repeat` exists in far fewer contexts than a simple loop. The whole point of using a module is that you don't have to worry about _how_ it works when implementing it in your project.

That’s also the whole point of using a function.

(For what it’s worth, I changed it from this to show off ES6.)

  function repeat(s, times) {
      return new Array(times + 1).join(s);
  }

  function padLeft(s, width, padCharacter) {
      var d = width - s.length;

      return d
Post reply on HN