Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I've Just Liberated My Modules

medium.com

Post reply on HN
Print view View original

521–530 of 827 posts

Re: I've Just Liberated My Modules

#521

Post by jakub_g »

kylecordes wrote: post #376
smaddox wrote: post #200

Earlier quoted context omitted.

I'm surprised all package managers don't use an IPFS-like system that uses immutable state with mutable labels and namespaces. Now that IPFS exists, and provides distributed hosting, it's even easier.

NPM doesn't even have immutable versions. Many would love to see this improved.

What you mean by that? It used to be possible to republish a version (it broke our build when a dep was republished with a breaking change, that's how I learnt about it) but this was fixed some 2-3 years ago IIRC

Re: I've Just Liberated My Modules

#522

Post by chakrit »

untog wrote: post #352
tdicola wrote: post #235

Earlier quoted context omitted.

Now that you own it what's to stop you from pushing out a new version with a slightly reworked string pad function under a commercial license (say a $100 per use fee)? Could make quite a pretty penny. Kind of crazy that this is possible at all.

What's to stop an original author doing the same thing? This isn't a new danger.

I think the point is the author is a new person.

You meet someone at a conference and the next conference he shows up again and you should know right away he's not actually somebody else.

Re: I've Just Liberated My Modules

#523

Post by biot »

jhall1468 wrote: post #440
overgard wrote: post #408

Earlier quoted context omitted.

The Apple thing doesn't work though, for a specific reason: it's a very common word/name. Smith is a very common surname. If one person starts the Smith Automobile Company and another person starts the Smith Farm, obviously there's no issue there. That's because none of us invented "Smith", it's understood to be a common name, etc. On the other hand, if I start "The Google Paper Company", I'm pretty damn sure I would…

That is not how trademarks work. Feel free to start the Google Paper Co. Uniqueness is not a merit for trademark infringement. To infringe you have to be a competitor.

That is how some trademarks work. Google is by now a famous mark and, as such, gets additional protection beyond what mere mortal companies do: http://itlaw.wikia.com/wiki/Famous_marks

I guarantee you won't last long if you start a Coca-Cola School of Hairdressing, even though the beverage company doesn't compete for that business.

Re: I've Just Liberated My Modules

#524

Post by jimjimjim »

pmontra wrote: post #518
jimjimjim wrote: post #448

I am obviously a old fossilized ancient developer. This situation seems like insanity. not the unpublishing part. the part where the thing that you require to sell/publish/do your job isn't under control or isn't stored within your organization. Am i wrong in thinking that you should just have a local copy of all of your source code dependencies. would it really take that much longer?

It's pretty common, to name only the ones I'm more used to Ruby has gems, Java maven, Perl CPAN, Node NPM, Python pip. All languages have package managers nowadays and has been like that for a long time. They give you the way to make local repositories but I don't know anybody doing it. Maybe developers working inside some companies have some process to go through the company repo. Setting up the repo and maintaining…

fair enough, but i'm still shaking my head. these places can't have QA departments.

Re: I've Just Liberated My Modules

#525

Post by iopq »

ubernostrum wrote: post #478
iopq wrote: post #475

Earlier quoted context omitted.

OK, now tell me how you can remove this file from BitTorrent (it's Fedora 18 KDE) magnet:?xt=urn:btih:14f146cdfaef83951ca9d3ac647e18e1977d1367 I'll wait

It's not about whether the removal is logistically possible, it's about whether a court can punish someone for failing to carry out the removal. Even when the former is actually impossible, a court could still punish for the latter. "Ha ha ha I use technology to cleverly show how futile your orders are" is not the kind of thing you want to say to a court with broad contempt powers.

The court can't punish you for not being able to do the impossible. That's ludicrous. "We have shut down all of our servers, yes. We can't stop people from downloading this, no"

Re: I've Just Liberated My Modules

#526

Post by tlrobinson »

nikolay wrote: post #362

IED [0] + IPFS [1] + GPG looks like a dream come true. Note: IED could be much faster than NPM installer due to parallel downloads, which would work great with the slower IPFS. [0]: http://gugel.io/ied/ [1]: https://ipfs.io/

That sounds super neat. I wonder how you could bootstrap a IPFS package repo from an existing one like npm's.

EDIT: just came across an IPFS backed npm registry mirror project: https://github.com/diasdavid/registry-mirror

Re: I've Just Liberated My Modules

#527

Post by AgentME »

ybrs wrote: post #389
nmjohn wrote: post #127

Earlier quoted context omitted.

Some examples of how it works: ^1.2.3 := >=1.2.3 =0.2.3 =0.0.3

Why dont they just use that version notation ? (>=0.0.2,<0.1.0) will be much simpler

For every single dependency in most projects that honor semver? ^ is just an extremely convenient shorthand.

Re: I've Just Liberated My Modules

#528

Post by raesene4 »

overgard wrote: post #287
callmevlad wrote: post #43

The fact that this is possible with NPM seems really dangerous. The author unpublished (erm, "liberated") over 250 NPM modules, making those global names (e.g. "map", "alert", "iframe", "subscription", etc) available for anyone to register and replace with any code they wish. Since these libs are now baked into various package.json configuration files (some with 10s of thousands of installs per month, "left-pad" with…

Do they seriously not use any sort of public key cryptography to sign packages? Frankly, for a project that's been around as long as NPM, that's downright irresponsible if that's the case. That's like package management 101.

Most of the programming language Package managers that I've seen either don't have the facility or it's not widely used.

Re: I've Just Liberated My Modules

#529

Post by joshuakarjala »

mschuster91 wrote: post #55

brouhaha, this is why you should not put node_modules into .gitignore (same for PHP's composer.lock and vendor/ folder). To be honest, I have waited for something like this to happen so that people finally wake up and realize how deeply and truly compromised the JS ecosystem really is. 11 SLOC not available any more and all over the internet builds are breaking etc.?! And please, why isn't essential stuff like this i…

some node modules compile platform specific binaries

Re: I've Just Liberated My Modules

#530

Post by BillinghamJ »

indiv0 wrote: post #397
patio11 wrote: post #385

Earlier quoted context omitted.

"So what you're saying is, your computers cannot possibly not continue damaging the plaintiff's interests." "That's correct." "You're being honest with me." "Yes, your Honor." "Will the computers continue harming the plaintiff's interests if shut off?" "... That would be dreadfully inconvenient, your Honor." "Do you have a more convenient solution?" "No, your Honor." "You are hereby ordered to turn off your computers…

How about a blockchain-based NPM? Can't take all the computers down. Legal, shmegal.

npm already replicates to hundreds of other servers. Right now, it is practically infeasible to actually remove packages permanently.
Post reply on HN