Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I've Just Liberated My Modules

medium.com

Post reply on HN
Print view View original

711–720 of 827 posts

Re: I've Just Liberated My Modules

#711

Post by drumstyx »

mc808 wrote: post #646
visarga wrote: post #428

Earlier quoted context omitted.

> But let's not lose the perspective - the author does not owe us or npm continued support On the other hand, he wanted his work published in the community registry where they got exposure and were made into dependencies in lots of projects. When the author offered their modules and then suddenly walked away with them, lots of innocent devs who built their projects with his modules got hurt. He did more bad than good…

> Now people will start wondering if a module with millions of installs in the last month is still going to exist tomorrow. That's a smart thing for people to wonder when there is a very real possibility that it won't. I'm not going to applaud the author's action here, which I consider reckless, but it did bring attention to how fragile this "essential" infrastructure really is.

It's not reasonable to be skeptical of every package. When you do that you get a mess of locally stored packages that end up out of date.

Should really just be a 'publish is forever' mentality

Re: I've Just Liberated My Modules

#712

Post by [deleted] »

echelon wrote: post #279
profmonocle wrote: post #181

Earlier quoted context omitted.

> And... I kind of want to say "once it's published, it's forever". This is effectively the norm with more traditional, curated package managers. Say I release a piece of open source software, and some Linux distro adds it to their package manager. Under a typical open source license, I have no legal right to ask them to stop distributing it. They can just say "sorry, you licensed this code to us under X license and…

I honestly wouldn't have a problem with them removing that option, and only allowing packages to be removed by contacting support with a good reason. (Accidental private info disclosure, copyright violation, severe security bug, etc.) Even Rust's Cargo won't allow you to revoke secrets [1]. I think this is the correct policy. [1] http://doc.crates.io/crates-io.html#cargo-yank

[deleted]

Re: I've Just Liberated My Modules

#713

Post by BinaryIdiot »

icebraining wrote: post #706
BinaryIdiot wrote: post #434

Earlier quoted context omitted.

Licensing doesn't really have anything to do with copyright / trademark / IP in general. It just grants you the ability to use something in the way specified. I'm not aware of case law where a license has been able to move the original IP from one party to another; I've only heard of that happening through standard legal documents. But I also pointed out that I wasn't sure how it would shake out anyway and was seekin…

But why are you saying the copyright was transferred? I don't see anything that implies that. Someone got a copy of the code under an irrevocable license that grants them to right to re-publish it, and that's what they are doing.

> But why are you saying the copyright was transferred?

I don't think I did?

> I don't see anything that implies that. Someone got a copy of the code under an irrevocable license that grants them to right to re-publish it, and that's what they are doing.

Yeah mostly curious if the original author could, say, use the DCMA or something similar to force npm to take it down if he really wanted to.

Re: I've Just Liberated My Modules

#714

Post by [deleted] »

sveiss wrote: post #595
appleflaxen wrote: post #574

Earlier quoted context omitted.

If they receive a court order, and there is no technical way to do that, then the court is out of luck. "A court might order it in the future" is not a design constraint on your decisions today.

Sure there's a technical way to do it: you unplug the server hosting it (or more likely, your hosting provider does that for you). No court is going to shed any tears over fact this has wider consequences than if you'd been able to comply with a narrower takedown request.

[deleted]

Re: I've Just Liberated My Modules

#715

Post by acjohnson55 »

brazzledazzle wrote: post #492
dwg wrote: post #177

Earlier quoted context omitted.

Having a multitude of small utilities like this is a great thing with many advantages. It may seem simple to write leftpad, but if 1000 projects that need it all write their own version, there will be at least 2000 more software bugs out there in the wild because of it. If you think that's rediculous, you're not being realistic about the huge disparity in skill levels of industry programmers as well as the considerab…

I'm curious since it strikes me as a hard problem to solve: How do you resolve having to deal with security issues with tens or hundreds of dependencies (and their dependencies)? How do you even know whether they have a security issue or a version bump is just a bug fix without digging into each one on a regular basis?

How do you know that you, as a lone developer, aren't writing insecure, unperformant, buggy code?

Re: I've Just Liberated My Modules

#716

Post by icebraining »

BinaryIdiot wrote: post #713
icebraining wrote: post #706

Earlier quoted context omitted.

But why are you saying the copyright was transferred? I don't see anything that implies that. Someone got a copy of the code under an irrevocable license that grants them to right to re-publish it, and that's what they are doing.

> But why are you saying the copyright was transferred? I don't think I did? > I don't see anything that implies that. Someone got a copy of the code under an irrevocable license that grants them to right to re-publish it, and that's what they are doing. Yeah mostly curious if the original author could, say, use the DCMA or something similar to force npm to take it down if he really wanted to.

I mean, you mentioned "take over the IP" and "move the original IP from one party to another", but I don't see why you're asking that, as NPM hasn't taken over any IP (nor has the new user), they simply redistributed the code.

Re: I've Just Liberated My Modules

#717

Post by kbenson »

techdragon wrote: post #552
kbenson wrote: post #380

Earlier quoted context omitted.

Or it's a "we're discussing internally, and would rather not deal with the shit-show that Github issues becomes once the issue becomes politicized and rampant misinformation and misguided activism take over."[1] There will be plenty of time for people to froth at the mouth and complain that they chose one way or the other once they've made a clear decision, which as of the locking the thread to collaborators, they ha…

I suspect your right, but honestly... His choice of language sounded much less like 'were thinking as a team', and much more like 'your all talking too loudly, you've given me a headache, so i'm going to shut you all up for a while'.

You mean the response that says, verbatim: "I'm thinking about the points that have been made, and I'm sure that we as a team will consider them going forward" ? Sure, he also says for now the behavior won't change, but that's the sane thing to do with the errors are rare, as changing something too quickly may introduce new bugs or unforeseen problems. Honestly, your interpretation of that comment is the exact reason why it's good to shut it down for a little while. The conversation gets so charged that even a "we need time to think about it" response is viewed negatively.

Re: I've Just Liberated My Modules

#718

Post by kctess5 »

ch4s3 wrote: post #301
yazaddaruvala wrote: post #281

Earlier quoted context omitted.

Lol, so if I'm understanding you correctly: Someone was nice enough to write some software, that is clearly indispensable. They were nice enough to not charge money for it. They were nice enough to support it, again free of cost. They were also nice enough to open source it, such that if it ever became more convenient for you to fork/change/do whatever you want with, that you would be able to. And when that same pers…

Are you serious? Nice enough to yank it without giving anyone advanced warning, (likely) knowing that it would break numerous projects? My guess based on the timing of his article and his petty argument with kik, is that he intended to cause this commotion to draw attention to his complaint against kik. He could have give the community warning so that major projects could have switched over to another package. So no,…

I had the same interpretation. "I'm gonna take my ball and go home"

Re: I've Just Liberated My Modules

#719

Post by ars »

akie wrote: post #550
ars wrote: post #472

Earlier quoted context omitted.

> Feel free to show a smaller implementation that's more efficient. How's this: function leftpad (str, len, ch) { ch = (len -= str.length) 0) ch += ch[0]; return ch + String(str); } No local variables, less manipulation of the input string, the string grows at the tail which is more efficient, and the code is much shorter. (With a bit of work you can use the longer ch string that is built to reduce the number of stri…

No offense, but that code is much more difficult to understand. If your goal is to minimize the amount of lines, then you succeeded. If the goal is to produce both correct and readable code, then there's room for improvement.

> No offense, but that code is much more difficult to understand.

I strongly disagree. My code has no magic initializers (the -1 in the original) and a simple linear code path, with no branching. It's very easy to read and understand.

The ternary operator at the top is simply read from left to right, it's not complicated.

> If your goal is to minimize the amount of lines, then you succeeded.

My goal was to maximize efficiency. Often that means less lines, but that was not the overt goal. And in fact this version runs faster, and uses less memory.

> If the goal is to produce both correct and readable code, then there's room for improvement.

You think so?

Then now it's your turn - rewrite this (or the original) to make it as readable as possible. I think you will find that a: mine is more readable than the original, and b: you won't be able to (need to) change much except to lift the len initializer out of the ternary operator in the first line onto its own line.

Re: I've Just Liberated My Modules

#720

Post by steveklabnik »

chc wrote: post #341
steveklabnik wrote: post #189

Earlier quoted context omitted.

Because npm stated it publicly on Twitter.

Huh, really? That's strange. I just checked both @npmjs and @izs and don't see any comment on the merits of the complaint now.

Further comment: turns out that npm lied about this. So I'm just straight-up wrong.
Post reply on HN