Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I've Just Liberated My Modules

medium.com

Post reply on HN
Print view View original

551–560 of 827 posts

Re: I've Just Liberated My Modules

#551

Post by jonathankoren »

dwg wrote: post #177
larkinrichards wrote: post #31

I applaud this action and while I'd like to point the finger at NPM, there's no real other method to fix historical package versions that depend on this. It is worth pointing to the silly state of NPM packages: Who decided that an external dependency was necessary for a module that is 17 lines of code? module.exports = leftpad; function leftpad (str, len, ch) { str = String(str); var i = -1; if (!ch && ch !== 0) ch =…

Having a multitude of small utilities like this is a great thing with many advantages. It may seem simple to write leftpad, but if 1000 projects that need it all write their own version, there will be at least 2000 more software bugs out there in the wild because of it. If you think that's rediculous, you're not being realistic about the huge disparity in skill levels of industry programmers as well as the considerab…

> As far as having many versions that all do the same thing, there is usually winners and losers over time. Because of this I believe that eventually the dependency graph shrinks overall.

That's... very naive. No one goes back and rewrites perfectly working code just to change a library. If it works don't touch it. Computers don't care, and if you rewrite it, you're introducing a bug. Also, there's plenty of new code to write! And oh yeah you have a billion little libraries, all used by an engineering culture constantly distracted by the new shinny, so you're going to be stuck with libraries that that haven't updated.

You're gonna have a bad time.

Re: I've Just Liberated My Modules

#552

Post by techdragon »

kbenson wrote: post #380
techdragon wrote: post #369

Earlier quoted context omitted.

Read the whole thread. Rather concerned by the final one. "Locking temporarily" to get away from the discussion? That feels sort of like the online discussion equivalent of sticking your fingers in your ears and going "la la la I'm not listening". I don't expect someone in their position to be unable to ignore a conversation and "take a break" but I would expect them to be capable of doing so without resorting to "su…

Or it's a "we're discussing internally, and would rather not deal with the shit-show that Github issues becomes once the issue becomes politicized and rampant misinformation and misguided activism take over."[1] There will be plenty of time for people to froth at the mouth and complain that they chose one way or the other once they've made a clear decision, which as of the locking the thread to collaborators, they ha…

I suspect your right, but honestly... His choice of language sounded much less like 'were thinking as a team', and much more like 'your all talking too loudly, you've given me a headache, so i'm going to shut you all up for a while'.

Re: I've Just Liberated My Modules

#554

Post by tragic »

r0muald wrote: post #444
giancarlostoro wrote: post #420

Earlier quoted context omitted.

I'm left thinking of how Go does it, whereby repositories are downloaded via git or whatever version control software's URL. Making it impossible for the admins of "NPM" to take down a package. Add in IPFS and you've got one heck of a "package manager" I guess Go's approach is not really a "package manager" but nobody can truly stop you from downloading from a git repository, and if they do, you can go to the forks e…

The same can happen with GitHub repositories, though, that is how the vast majority of Go packages get published. It's almost as if privately controlled, centralized archives are a bad idea.

1. However, it would deal with GP's problem - that is, that somebody else could upload a package with the same name as one of the ones removed and cause ... surprises the next time someone runs npm install.

Github repos are namespaced to their owners, at least, radically reducing the potential for this kind of thing.

2. /s/github/whatever . As long as there's a public URL from which something can be cloned, the idea still works, as long as that URL doesn't someday point to something completely different. Again, not impossible, but less likely than with NPM.

3. There are, like it or not, real advantages to centralised archives - discoverability, optimisation of dependency resolution, etc. 'Privately controlled' is an elastic idea - it seems to me that there's a difference between a non-profit foundation, say, and a for-profit company like NPM or GH, but both are 'privately controlled'. The question is whether these advantages outweigh the disadvantages. In my opinion, they do.

Re: I've Just Liberated My Modules

#555

Post by swang »

jonathankoren wrote: post #486

My god! It's full of attack vectors! https://github.com/substack/provinces/issues/20

kinda a dick move to unpublish a module not created by you. but hey NO TIME FOR THAT when your HONOR of naming something kik is in jeopardy from npm.

Definitely, definitely, not a knee-jerk reaction.

Re: I've Just Liberated My Modules

#556

Post by krylon »

vincent_s wrote: post #539
nordsieck wrote: post #157

One interesting thing to me, is that it is pretty clear that the kik lawyers pretty dramatically over enforced their trademark. For those who don't know, the purpose of trademarks is to prevent customer confusion; essentially we don't want people to be able to sell cheap knock-offs of someone else's thing without the general public being able to easily distinguish between them. In practical terms, trademarks are "sco…

Most Germans wouldn't know that kik is also a chat app ;-) "KiK is the largest textile discounter chain in Germany and operates about 3,200 stores in Germany, Austria (since 1998), Slovenia and Czech Republic (since 2007), Hungary and Slovakia (since 2008), Croatia (since 2011) and Poland (since March 2012)." https://en.wikipedia.org/wiki/KiK

Being from Germany, I had initially assumed that was in fact the company in question. I was wondering why a textile discounter would care about some NPM module...

Re: I've Just Liberated My Modules

#557

Post by tarsinge »

smsm42 wrote: post #348

Reading some of the comments reminds me old tale about a young man, that every morning on his way to work passed by a beggar and gave him a coin (that was back when coins actually had some value). One morning though the beggar notices the coin is smaller than usual, and he asks: - Why you gave me a different coin today? and the young man says: - I got married and now I'm starting a family, I need more money so I can…

A more accurate story would be: A young man is giving a piece of wood for free to a beggar. Then one day, when the beggar has constructed a house using the wood, the young man asks it back :

- But you gave it to me!

- It was for free, so don't dare you to complain

If it was given with the (maybe implicit) clause that there was no limit of time, I don't see how the thing being free give you the right to take it back, especially from people who have used it to build something. Sure the first act was charitable, but in the end you cause more harm than good.

Re: I've Just Liberated My Modules

#558

Post by pluma »

swang wrote: post #28

Was that lawyer overreaching? I don't know. But for this guy to expect npm to use their resources to defend him (which they may even possibly lose!) and get mad at them is... a bit presumptuous? Github isn't open source either so is he going to get mad when the lawyers send them an email about kik?

NPM Inc like to pretend NPM is infrastructure so they should act like infrastructure. Reinstating the unpublished version of the unpublished module was okay. Taking down a package over an unclear trademark dispute without also informing the author and the public about their reasoning was not.

For all we know the claim may have been invalid and npm just doesn't want to risk legal expenses but because they made the decision in private we won't know until they release the prepared statement.

Re: I've Just Liberated My Modules

#559

Post by Fiahil »

ubernostrum wrote: post #423
indiv0 wrote: post #397

Earlier quoted context omitted.

How about a blockchain-based NPM? Can't take all the computers down. Legal, shmegal.

You can still be jailed for contempt of the order, though. "I've found a clever workaround for court orders" doesn't work around that bit.

Just live outside of the United States, and you'll be fine.
Post reply on HN