Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I've Just Liberated My Modules

medium.com

Post reply on HN
Print view View original

731–740 of 827 posts

Re: I've Just Liberated My Modules

#731

Post by joh6nn »

mattmanser wrote: post #679
gedrap wrote: post #575

Earlier quoted context omitted.

No, he's just careful and professional. Pulling packages from npm on every build in relying on it seems like fine for a little startup that no one would actually care if it went down for a day or two. That's fine. But there are plenty of applications where it would be a catastrophic fuck up to break things because someone somewhere decided to delete something.

This is some sort of joke right? 99% of developers will use npm directly, anyone claiming otherwise and also claiming that everyone else doesn't have a QA department because they do this is completely OOT and from a different decade. This thread has massive upvotes and a mass of comments precisely because this is what everyone does. It's utterly ridiculous to claim otherwise.

your logic is flawless

Re: I've Just Liberated My Modules

#733

Post by nikolay »

tlrobinson wrote: post #526
nikolay wrote: post #362

IED [0] + IPFS [1] + GPG looks like a dream come true. Note: IED could be much faster than NPM installer due to parallel downloads, which would work great with the slower IPFS. [0]: http://gugel.io/ied/ [1]: https://ipfs.io/

That sounds super neat. I wonder how you could bootstrap a IPFS package repo from an existing one like npm's. EDIT: just came across an IPFS backed npm registry mirror project: https://github.com/diasdavid/registry-mirror

The good outcome of this nasty incident (especially with the followed hijacking) is that it was a wake-up and (hopefully!) package managers will take notice!

Re: I've Just Liberated My Modules

#734

Post by awolden »

julie1 wrote: post #465

The number of coders complaining about an author exercising the basic of intellectual property rights is too high. 1) all coders should understand authors right be the code free or closed; 2) there is no excuse for someone whose value is based on creativity to ignore how IP works (the good and the bad part) because our comfortable incomes come from the protection these rights gives to our work 3) if your code is brok…

> 3) if your code is broken for 11 sloc, maybe you depend too much on others work and you have no value yourselves.

That is very out of touch with the reality of development on the modern JS stack. Babel is a key transpiler that allows people to target multiple browsers with consistent JS, and it was completely broken by this move. Are you suggesting that everyone rewrite their own babel? I guess if they don't they have no real `value`.

Re: I've Just Liberated My Modules

#735

Post by flurdy »

Can NPM not add to their TOS and features a "notice period"? With a grace period for errors e.g. if published and older than one week to remove a package you have to give notice first, e.g. 2 months. With a suspension before actual removal?

With some avenues for expedite removal/suspension ie security and legal, which would have removed kik quicker but not leftpad.

Whether people would be aware of the notices or ignore them is another issue.

Re: I've Just Liberated My Modules

#736

Post by BinaryIdiot »

icebraining wrote: post #716
BinaryIdiot wrote: post #713

Earlier quoted context omitted.

> But why are you saying the copyright was transferred? I don't think I did? > I don't see anything that implies that. Someone got a copy of the code under an irrevocable license that grants them to right to re-publish it, and that's what they are doing. Yeah mostly curious if the original author could, say, use the DCMA or something similar to force npm to take it down if he really wanted to.

I mean, you mentioned "take over the IP" and "move the original IP from one party to another", but I don't see why you're asking that, as NPM hasn't taken over any IP (nor has the new user), they simply redistributed the code.

npm didn't take it over, another user did and npm helped re-publish the unpublished version. I already answered the why I asked that..."mostly curious if the original author could, say, use the DCMA or something similar to force npm to take it down if he really wanted to."

Re: I've Just Liberated My Modules

#737

Post by noffle »

viraptor wrote: post #421
smaddox wrote: post #200

Earlier quoted context omitted.

I'm surprised all package managers don't use an IPFS-like system that uses immutable state with mutable labels and namespaces. Now that IPFS exists, and provides distributed hosting, it's even easier.

As much as I agree, IPFS is still very much under construction and I don't think any known package managers got started after IPFS was reliable. You can experiment with ipfs-backed git remotes though. That's already possible.

gx is a generic package manager on top of IPFS that uses git-style hooks for adding per-language support. It's already being used to manage dependencies on the go-ipfs project: https://github.com/whyrusleeping/gx

Bonus: there's also a IPFS git remote implementation! https://github.com/cryptix/git-remote-ipfs

Re: I've Just Liberated My Modules

#739

Post by icebraining »

BinaryIdiot wrote: post #736
icebraining wrote: post #716

Earlier quoted context omitted.

I mean, you mentioned "take over the IP" and "move the original IP from one party to another", but I don't see why you're asking that, as NPM hasn't taken over any IP (nor has the new user), they simply redistributed the code.

npm didn't take it over, another user did and npm helped re-publish the unpublished version. I already answered the why I asked that... "mostly curious if the original author could, say, use the DCMA or something similar to force npm to take it down if he really wanted to."

But the user didn't take over the IP, it only took over the name on NPM's registry.

As for the DMCA, usually not since most FOSS licenses are explicitly irrevocable, but with the WTFPL, who knows.

Re: I've Just Liberated My Modules

#740

Post by jlg23 »

vehementi wrote: post #186
jlg23 wrote: post #12

Seriously? "When I started coding Kik, didn’t know there is a company with same name. And I didn’t want to let a company force me to change the name of it. After I refused them, they reached NPM’s support emphasizing their lawyer power in every single e-mail CC’ing me. I was hoping that NPM would protect me, because I always believed that NPM is a nice organization." a) Ignorance is no excuse. b) Expecting others to…

> b) Expecting others to fight for one is lame. Either have the balls and fight or STFU. Is this a joke? In the world of hilariously over litigious rich companies crushing people with the threat of lawsuits? If you don't have the balls to defend your company vs patent trolls shut the fuck up? Hahaha.

He neither contacted a lawyer on his own to check whether kik's claim was valid nor did he contact npm while he still received all mails from kik to npm in Cc. He was just trying to sit it out and then caused a lot of collateral damage by pulling all his modules.

I have dealt with a few such problems myself and more often than not a simple counter demand that the other party should substantiate their claim was enough to make the claim go away.

And this is not even a multi-billion dollar patent troll - it was merely about a trademark, which every lawyer should be able to check in 30 minutes.

Post reply on HN