Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I've Just Liberated My Modules

medium.com

Post reply on HN
Print view View original

661–670 of 827 posts

Re: I've Just Liberated My Modules

#661

Post by dctoedt »

patio11 wrote: post #385
Joky wrote: post #350

Earlier quoted context omitted.

I'm not sure how the court could force you to do something you can't possibly do...

"So what you're saying is, your computers cannot possibly not continue damaging the plaintiff's interests." "That's correct." "You're being honest with me." "Yes, your Honor." "Will the computers continue harming the plaintiff's interests if shut off?" "... That would be dreadfully inconvenient, your Honor." "Do you have a more convenient solution?" "No, your Honor." "You are hereby ordered to turn off your computers…

What Patrick says is technically true. But before granting the "extraordinary remedy" of an injunction, U.S. courts would apply the traditional four-factor test, which includes assessing:

+ the balance of hardships between allowing the conduct in question to continue vs. issuing the injunction;

+ whether the damage being caused by the conduct in question could be satisfactorily remedied by a payment of money as opposed to a mandate or a prohibition; and

+ (importantly) the public interest.

See, e.g., the Supreme Court's discussion of the four-factor test in eBay v. MercExchange, 547 U.S. 388 (2006), https://scholar.google.com/scholar_case?case=481934433895457...

Re: I've Just Liberated My Modules

#662

Post by heavenlyhash »

lmm wrote: post #588
heavenlyhash wrote: post #305

Earlier quoted context omitted.

Except this very same string of events makes it quite obvious that versions aren't systematically immutable. And vast numbers of people are suddenly shocked (shocked!) to realize there's no mechanical verification of stuff like this. It can all happen whimsically, and the result isn't just a loss of service, it's service with different results and no verification nor notice .

> Except this very same string of events makes it quite obvious that versions aren't systematically immutable. From this thread it sounds like: a) npm specifically overrode their normal process to allow him to publish new code at the same version number b) npm did verify that the code he was publishing was the same as the old code at that version number as part of this. So sounds like immutability of specific version…

"npm" is two things in this picture: the server and centralized service, and the software tool on everyone's build/dev machines.

There's a difference between trusting a server to do something, and having the software you're using check that the server hasn't changed its behaviors in ways that may... fuck with the continuity of your zen.

If someone can decide to do a special thing that happens to break all promises, and my side of the tooling doesn't let me know, much less let me confirm acceptance of the changes, then my side of the tooling is seriously deficient.

And in a situation where this tooling then starts executing new code from a new author on my host as my user without any authentication except "trust the server"... the same behavior describes $script_kiddie_virus_of_the_week! "download code from C&C server; run it, thanks:D" What's the difference between this and outright RCE exploit? "good intentions"?

I'd rather have something more than "good intentions" controlling what code ends up running on my computer, thanks.

Re: I've Just Liberated My Modules

#663

Post by ArneBab »

cookrn wrote: post #169
_nfin wrote: post #130

Earlier quoted context omitted.

So we need gpg signed packages :> And... all packages should be namespaced under the author who published them. And... I kind of want to say "once it's published, it's forever".

What if such a system was implemented using IPFS[0] (or similar) for storage? [0] https://github.com/ipfs/ipfs

There’s already apt-get over Freenet: http://127.0.0.1:8888/freenet:USK@oRy7ltZLJM-w-kcOBdiZS1pAA8...

Re: I've Just Liberated My Modules

#664

Post by tobltobs »

antihero wrote: post #587
bsder wrote: post #203

Earlier quoted context omitted.

> They have the responsibility to defend their trademark, otherwise it could be abused by a rival claiming they did not adequately defend it. Agreed, but you can do this without pissing off everybody in the universe. http://www.businessinsider.com/jack-daniels-wrote-what-has-t... Before, I had no idea who kik was. Now , I know them as a bunch of jerks. Big fail for a "social media" company.

Yeah but literally nobody is going to care about this outside the programmer community, and we're not their target audience.

"Are you a developer? Kik has open-sourced tools and libraries to help you create great web experiences ..."

This is on their homepage. They want developer to use their Pedo enabler API.

Re: I've Just Liberated My Modules

#665

Post by jameshart »

CydeWeys wrote: post #56
jlg23 wrote: post #46

Earlier quoted context omitted.

And I think you missed the point of my response. I chose a admittedly drastic picture to get across the point about causing collateral damage.

Hyperbolic analogies don't prove points though.

Hyperbolic analogies are a perfectly valid tool for refuting absolute statements, in particular arguments of the form 'the end justifies the means'.

If someone argues that some $noble_end is served by $means_under_debate, as a justification for the means, that argument can be refuted by giving a circumstance where the same $noble_end is served by some $extreme_means where both parties can agree that $extreme_means is never justifiable.

Then once we've agreed that the form of that argument doesn't work, it is reduced to 'the ends justify sufficiently noble means', we can move on to discuss whether the $means_under_debate are sufficiently noble, setting aside the fact they they lead to $noble_end.

Re: I've Just Liberated My Modules

#667

Post by rboyd »

sveiss wrote: post #595
appleflaxen wrote: post #574

Earlier quoted context omitted.

If they receive a court order, and there is no technical way to do that, then the court is out of luck. "A court might order it in the future" is not a design constraint on your decisions today.

Sure there's a technical way to do it: you unplug the server hosting it (or more likely, your hosting provider does that for you). No court is going to shed any tears over fact this has wider consequences than if you'd been able to comply with a narrower takedown request.

This combined with the cost of hosting (I remember the ruby community freaking out over rubygems costs a couple years ago) makes me think maybe we're evolving towards decentralized dependency hosting. Something like Storj where users offset hosting fees with blockchain payments when dependencies are fetched.

Re: I've Just Liberated My Modules

#668

Post by EdwardDiego »

r0muald wrote: post #444
giancarlostoro wrote: post #420

Earlier quoted context omitted.

I'm left thinking of how Go does it, whereby repositories are downloaded via git or whatever version control software's URL. Making it impossible for the admins of "NPM" to take down a package. Add in IPFS and you've got one heck of a "package manager" I guess Go's approach is not really a "package manager" but nobody can truly stop you from downloading from a git repository, and if they do, you can go to the forks e…

The same can happen with GitHub repositories, though, that is how the vast majority of Go packages get published. It's almost as if privately controlled, centralized archives are a bad idea.

Hasn't hurt Java devs any. Although we have plenty of mirrors and no concept of unpublishing.

Re: I've Just Liberated My Modules

#669

Post by LukeB_UK »

pluma wrote: post #631
st3v3r wrote: post #14

Hopefully NPM will think of this in the future, next time they try something like this.

Let's remember that NPM Inc has also been toying with the idea of banning IPs associated with "bad people" for behaviour outside of NPM itself. In other words: they think it's morally justifiable to ban a company's IP address(es) from the NPM service because one of their employees said something objectionable on Twitter (not involving NPM or any of its representatives). And what should the company do if their employe…

Care to give a source for that claim?

Re: I've Just Liberated My Modules

#670

Post by TimJRobinson »

Quick script to test if your project is using any of the modules he unpublished:

  for module in $(curl -s https://gist.githubusercontent.com/azer/db27417ee84b5f34a6ea/raw/50ab7ef26dbde2d4ea52318a3590af78b2a21162/gistfile1.txt); do grep "\"$module\"" package.json; done
If any names appear you should replace them or force that specific version always (remove ~ or ^ before it). If nothing appears you're probably good.
Post reply on HN