611–620 of 827 posts
The other issues is a lack of distributed package/artifact replication which makes it possible to take down an entire ecosystem by unplugging a few servers.
Google.
(why is this getting frontpage HN coverage?)
a trademark is a globally enforceable right (madrid agreement) and one has an obligation to protect ones mark from "dilution" from others in the same category:
i.e. if you are selling "apple" garden shovels, you needn't worry about crossing into "apple" computer land, but I guarantee you that they already registered that mark for "home electronics" etc.
Most countries require formal registration of the trademark (they are searchable in online databases) and most will go on a "first filing" basis. but several, including the USA, go by a "first usage" basis and require you to prove your use of the mark in public...
it's a long shot, but you can always look of that company has, in fact, registered that mark, and in which country/territory are they claiming usage rights.
(for example, they can't be a local computer shop named "apple computers" that only sold to locals since 1854, that suddenly sells computers on the global market, as there is already a global entity with that name registered)
I am obviously a old fossilized ancient developer. This situation seems like insanity. not the unpublishing part. the part where the thing that you require to sell/publish/do your job isn't under control or isn't stored within your organization. Am i wrong in thinking that you should just have a local copy of all of your source code dependencies. would it really take that much longer?
It's pretty common, to name only the ones I'm more used to Ruby has gems, Java maven, Perl CPAN, Node NPM, Python pip. All languages have package managers nowadays and has been like that for a long time. They give you the way to make local repositories but I don't know anybody doing it. Maybe developers working inside some companies have some process to go through the company repo. Setting up the repo and maintaining…
NPM makes it quite awkward to use a non-standard repository, and often builds will download stuff from GitHub on-the-fly rather than hosting all their sources in NPM. It's not my favourite package manager :(. But you're going to need to put your own packages somewhere, and there's little reason not to make that somewhere not also cache your external dependencies.
Earlier quoted context omitted.
> My point is mostly that often, when it comes to law, lay-people talk about what they _wish_ the law was, rather than what the law actually is. That is why the law should be formalized such that correctness proofs for argumentations can be given and in doubt even be checked independently by a computer. Exactly because of the possibility of different opinions and wishes, coming up with such a high standard should be…
There are a near-infinite set of complexities in legal cases. Trying to create a formalism for such laws would require solving the entire field of ethics to decide at which point something might be considered "reasonable doubt".
As far as I know this is a mostly done problem (google "statistics").
Earlier quoted context omitted.
Do they seriously not use any sort of public key cryptography to sign packages? Frankly, for a project that's been around as long as NPM, that's downright irresponsible if that's the case. That's like package management 101.
Most of the programming language Package managers that I've seen either don't have the facility or it's not widely used.
For example, RubyGems it's possible to sign them, but it's not used as much as it should be because option security never gets used. Waxseal is a gem to sign other gems.
Generally though, it's a worse vulnerability than bitsquatting because it gives quarter to silent, advanced, persistent threats by definition. (Dynamic, untrusted code modification either in-flight or at-rest in difficult to prevent/audit ways.)
The primary way for change to happen is for some company to get hacked, but then it will only change for that one platform because most people are reactive not proactive. Changing this proactively seems painful, but it's less onerous than the risks of the alternatives. The key point is to make end-to-end verification and public key management mandatory and simple.
Earlier quoted context omitted.
So we need gpg signed packages :> And... all packages should be namespaced under the author who published them. And... I kind of want to say "once it's published, it's forever".
What if such a system was implemented using IPFS[0] (or similar) for storage? [0] https://github.com/ipfs/ipfs
I really just hope that this guy just didn't know what he was doing and what effect it would have. Otherwise it is totally irresponsible to mess up a big project like babel just because you control a few lines of trivial code.
Can't believe the dev is made out to be the bad guy here. It may be a "few lines of trivial code" but it is still his code and he has the right to do whatever he wants with it. He tried the reasonable thing, NPM didn't oblige, he pulled the rug. Serves them right. If it's a few lines of "trivial code", then maybe big project Babel should stop using that "trivial code"? And why does this yet-another-messenger-flash-in…
Was he irresponsible? That seems a bit much, I think he was at responsibility level average - he did what he had the right to do and with good reason after NPM treated him badly and published a good document outlining the reasons, which I guess was helpful for people seeing why using NPM at all might actually be irresponsible.
But he could have been more than responsibility level average.
The fact that this is possible with NPM seems really dangerous. The author unpublished (erm, "liberated") over 250 NPM modules, making those global names (e.g. "map", "alert", "iframe", "subscription", etc) available for anyone to register and replace with any code they wish. Since these libs are now baked into various package.json configuration files (some with 10s of thousands of installs per month, "left-pad" with…
Legally isn't it totally NPM as a company to publish existing versions of left-pad because those versions were already released under a license that allows redistribution, whether the author wants them to or not? Or can the author effectively veto this?
The separate question is: ethically or business-wise, do they want to continue publishing code from an author who explicitly tells them not to? Legally they (almost certainly) could, but as a FOSS business, would they want to?
Software Licenses are pretty easy for the basics - after you read the whole thing.
Earlier quoted context omitted.
Spam was mentioned because it's a brand name that became generic because it wasn't protected aggressively enough. Coke, Xerox, and Kleenex are other classic examples of brands that are commonly used generically, and the company owning their trademarks must aggressively send threats (that they rarely follow up on) just out of legal necessity.
Spam very aggressively protects their trademark. So aggressively that it lost a trademark lawsuit against Spam Arrest. (They lost cause people don't get food and junk mail confused)