Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I've Just Liberated My Modules

medium.com

Post reply on HN
Print view View original

601–610 of 827 posts

Re: I've Just Liberated My Modules

#601

Post by danneu »

melvinmt wrote: post #363
tobltobs wrote: post #242

Earlier quoted context omitted.

Seems that we should now prefix any package name with a random string like 'skdjdihsawqy'. This way you could maybe avoid to be the target for some of those 'has to proof itself' lawyers.

Or, you know, prefix with author's username, a la Github.

This would solve classes of issues with the npm ecosystem (many of which remind me of trying to register a domain name) like name-squatting, trying to think up a marketable-but-untaken name, and ownership transfer.

OP claimed a bunch of sweet dictionary words (concat, iframe, door, bud, alert, map) and new owners are now claiming them and it's a security disaster. But it'd be a lot less interesting if they unpublished "azer/map", "azer/alert", "azer/iframe", etc. and new owners republished under their own names.

Elm packages got this right: http://package.elm-lang.org/

Re: I've Just Liberated My Modules

#602

Post by douche »

_ZeD_ wrote: post #474
cballard wrote: post #63

Earlier quoted context omitted.

> Developers: less dependencies is better, especially when they're so simple! No! The opposite of that. Lots of little µframeworks, defining composable and generic types, is much better than a giant monolith. The Swift Package Manager is taking this approach, and I think it's great: https://github.com/apple/swift-package-manager#modules The caret character doesn't appear anywhere in the semver spec, so whatever that…

...and I am in my little python world with "batteries included"...

And I in Java and .Net world, where it is more like "nuclear reactor included..."

Re: I've Just Liberated My Modules

#603

Post by coldtea »

Fiahil wrote: post #559
ubernostrum wrote: post #423

Earlier quoted context omitted.

You can still be jailed for contempt of the order, though. "I've found a clever workaround for court orders" doesn't work around that bit.

Just live outside of the United States, and you'll be fine.

Yeah, because the US doesn't have treaties with most of the world...

Re: I've Just Liberated My Modules

#604

Post by oblio »

patio11 wrote: post #385
Joky wrote: post #350

Earlier quoted context omitted.

I'm not sure how the court could force you to do something you can't possibly do...

"So what you're saying is, your computers cannot possibly not continue damaging the plaintiff's interests." "That's correct." "You're being honest with me." "Yes, your Honor." "Will the computers continue harming the plaintiff's interests if shut off?" "... That would be dreadfully inconvenient, your Honor." "Do you have a more convenient solution?" "No, your Honor." "You are hereby ordered to turn off your computers…

> The legal system interprets attempts to route around it as damage and responds to damage with overwhelming force.

In other words, Hulk Hogan vs Gawker.

Re: I've Just Liberated My Modules

#605

Post by oblio »

lmm wrote: post #598
mike_hearn wrote: post #579

Earlier quoted context omitted.

I really doubt anyone checks them. It's not integrated or enabled by default, there's no way to pin keys in the build files, etc. GPG isn't the solution to such problems, unfortunately. In one of my old projects (bitcoinj) we did write a Maven plugin that let you put the hashes of the dependencies into your build file. However it's rare to see Maven/Gradle builds that accept version ranges. And once downloaded it's c…

There's a plugin for checking it in maven ( http://www.simplify4u.org/pgpverify-maven-plugin/plugin-info... ) that allows pinning the keys. Ranges are rare but I'm not sure why - maven actually has very good support for them. I guess it's just that they're not the default?

Version ranges can create inconsistent builds. That's why they're not default and that's why they're not really recommended.

Re: I've Just Liberated My Modules

#607

Post by bryanrasmussen »

swang wrote: post #89
maxaf wrote: post #54

Earlier quoted context omitted.

Taking an idea to the logical extreme is an effective means of invalidating said idea. How many UNIX utilities are 17 silly lines long? A bit of code duplication would go a long way towards bringing sanity to JS land.

yes, let's blow up the entire concept that's worked fine for the ~5 years of node's existence because one dude did something extreme.

is unpublishing a module extreme?

Re: I've Just Liberated My Modules

#608

Post by bryanrasmussen »

andy9775 wrote: post #22
chvid wrote: post #6

In case anyone is wondering what was in the now broken dependency - here is the source code in full: module.exports = leftpad; function leftpad (str, len, ch) { str = String(str); var i = -1; if (!ch && ch !== 0) ch = ' '; len = len - str.length; while (++i https://github.com/azer/left-pad/blob/master/index.js

17 lines of JS causes so much havoc. Knew this would eventually happen, but I thought the code would have been more interesting

the more basic the functionality the more widespread its usage.

Re: I've Just Liberated My Modules

#609

Post by douche »

tarsinge wrote: post #557
smsm42 wrote: post #348

Reading some of the comments reminds me old tale about a young man, that every morning on his way to work passed by a beggar and gave him a coin (that was back when coins actually had some value). One morning though the beggar notices the coin is smaller than usual, and he asks: - Why you gave me a different coin today? and the young man says: - I got married and now I'm starting a family, I need more money so I can…

A more accurate story would be: A young man is giving a piece of wood for free to a beggar. Then one day, when the beggar has constructed a house using the wood, the young man asks it back : - But you gave it to me! - It was for free, so don't dare you to complain If it was given with the (maybe implicit) clause that there was no limit of time, I don't see how the thing being free give you the right to take it back,…

It's more like the young man telling the beggar that he can come cut the wood from his land for free. Then one day the young man stops letting the beggar cut his wood for free. He's not taking back the wood that's already been cut. The problem is if the beggar wasted the wood he did take, and took for granted the assumption that he would always be able to get more.

Relying on something continuing to exist on the internet, without making your own backups of it, and you're going to have a bad time.

Re: I've Just Liberated My Modules

#610

Post by ShaneCurcuru »

jahewson wrote: post #246

This is a really bad decision on npm's part. Kik's laywer has pulled a fast one on them. Kik has no right to enforce the Kik trademark beyond the limited set of goods and services listed in the trademark application [1]. Kik is a registered word mark for mobile messaging software only . That's why the trademark database contains many entries for just the word Kik, other companies own the use of that word for other go…

Trademarks: even more understood to modern programmers than C++ multiple inheritance.

Trademark owners - especially registered ones - can ask you to treat their mark any way they like. Legally, they can only try to enforce the basics of trademark law, but trademark litigation is typically expensive and risky.

USPTO Pro Tip: links to their search are session-specific. You have to use the blue TSDR link to share:

https://tsdr.uspto.gov/#caseNumber=86930821&caseType=SERIAL_...

Post reply on HN