Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I've Just Liberated My Modules

medium.com

Post reply on HN
Print view View original

761–770 of 827 posts

Re: I've Just Liberated My Modules

#761

Post by jessaustin »

nostrademons wrote: post #742
jacobr wrote: post #501

Earlier quoted context omitted.

You don't get any prepublish hook when pushing to a git repository though, so you can't do things like preprocess with babel, typescript, etc, unless you check in the compiled source.

You do, actually, if you've setup the git repository correctly. https://git-scm.com/book/en/v2/Customizing-Git-Git-Hooks Check out the pre-push, pre-receive, update, and post-update hooks.

Those hooks aren't tracked in the repo though, are they? In many cases that will be inconvenient.

Re: I've Just Liberated My Modules

#762

Post by BinaryIdiot »

icebraining wrote: post #739
BinaryIdiot wrote: post #736

Earlier quoted context omitted.

npm didn't take it over, another user did and npm helped re-publish the unpublished version. I already answered the why I asked that... "mostly curious if the original author could, say, use the DCMA or something similar to force npm to take it down if he really wanted to."

But the user didn't take over the IP, it only took over the name on NPM's registry. As for the DMCA, usually not since most FOSS licenses are explicitly irrevocable, but with the WTFPL, who knows.

> But the user didn't take over the IP, it only took over the name on NPM's registry.

That's almost the same thing. Like if someone dropped their domain name and you grabbed it up. The customer / user isn't going to notice a difference but it's now being represented by someone else.

I don't think anyone cares enough to really do anything about this though. Mostly curious if it was possible to do something about it but I'm guessing the waters are pretty untested.

Re: I've Just Liberated My Modules

#763

Post by howeyc »

jerf wrote: post #24

This is why you should vendor it. What is "it"? All of it, whatever it may be. You should be able to build your systems without an internet connection to the outside world. I say this with no reference to particulars of your language or runtime or environment or anything else. This is merely a specific example of something that could happen to a lot of people, in a lot of languages. It's just a basic rule of professi…

I don't undertand why this isn't the most common reaction, maybe people don't want to take this much responsibility over their builds since they've grown used to it being "taken care of" by these central package repositories for them?

Still relying on internet connection for builds to pass seems rather silly to me.

Re: I've Just Liberated My Modules

#764

Post by darkarmani »

visarga wrote: post #428
smsm42 wrote: post #348

Reading some of the comments reminds me old tale about a young man, that every morning on his way to work passed by a beggar and gave him a coin (that was back when coins actually had some value). One morning though the beggar notices the coin is smaller than usual, and he asks: - Why you gave me a different coin today? and the young man says: - I got married and now I'm starting a family, I need more money so I can…

> But let's not lose the perspective - the author does not owe us or npm continued support On the other hand, he wanted his work published in the community registry where they got exposure and were made into dependencies in lots of projects. When the author offered their modules and then suddenly walked away with them, lots of innocent devs who built their projects with his modules got hurt. He did more bad than good…

> When the author offered their modules and then suddenly walked away with them, lots of innocent devs who built their projects with his modules got hurt. He did more bad than good overall, especially that he unpublished hundreds of modules at once without warning, not just one. He should carry some responsibility for that.

Blame NPM. They were the ones shutting down his module and giving it to someone else. That's the first of the crazy parts.

Re: I've Just Liberated My Modules

#765

Post by niutech »

cookrn wrote: post #169
_nfin wrote: post #130

Earlier quoted context omitted.

So we need gpg signed packages :> And... all packages should be namespaced under the author who published them. And... I kind of want to say "once it's published, it's forever".

What if such a system was implemented using IPFS[0] (or similar) for storage? [0] https://github.com/ipfs/ipfs

There is already gx package manager: https://github.com/whyrusleeping/gx

Re: I've Just Liberated My Modules

#766

Post by jhall1468 »

johannes1234321 wrote: post #672
jhall1468 wrote: post #451

Earlier quoted context omitted.

That. Is. Not. How. Trademarks. Work. A trademark gives you protection of a mark within a specific industry. "Software" is not a specific industry. They do not get wholesale ownership of the term. And if you blindly install a module, expecting it to be some official release without looking it up, you're an idiot.

See class 9 of the Nice categories. If you claim a trademark For class 9 it includes "all computer programs and software regardless of recording media or means of dissemination, that is, software recorded on magnetic media or downloaded from a remote computer network." Also mind the way this practically works: A company will try to register a mark in as many categories as possible.

That's just incorrect.

NICE Class 9 is far more extensive than that:

"Scientific, nautical, surveying, photographic, cinematographic, optical, weighing, measuring, signalling, checking (supervision), life-saving and teaching apparatus and instruments; apparatus and instruments for conducting, switching, transforming, accumulating, regulating or controlling electricity; apparatus for recording, transmission or reproduction of sound or images; magnetic data carriers, recording discs; compact discs, DVDs and other digital recording media; mechanisms for coin-operated apparatus; cash registers, calculating machines, data processing equipment, computers; computer software; fire-extinguishing apparatus."

Computers programs are a part of 090373 which has a breakdown of ~100 subcategories.

There are 45 Nice classes. Being in the same top-level class is not confusingly similar. Unless you think Kik Marine Compasses and Kik Instant Messenger might be confusingly similar.

Re: I've Just Liberated My Modules

#767

Post by jhall1468 »

tempestn wrote: post #479
jhall1468 wrote: post #440

Earlier quoted context omitted.

That is not how trademarks work. Feel free to start the Google Paper Co. Uniqueness is not a merit for trademark infringement. To infringe you have to be a competitor.

That is incorrect. You are also infringing if people could reasonably assume an affiliation due to your use of the trademark, which would definitely be the case with Google Paper Co. You're basically piggy-backing on (and diluting) the brand recognition they've built.

You are correct in that my Google example would likely be trademark infringement because Google is a famous mark. Kik is not a famous mark, so for this case the famous/well-known aspect of trademark infringement is entirely moot.

And keep in mind that the OP I was responding to was arguing that if the name is unique it gets extra protection. That's false. Fame offers extra protection, uniqueness does not.

Re: I've Just Liberated My Modules

#768

Post by nostrademons »

jessaustin wrote: post #761
nostrademons wrote: post #742

Earlier quoted context omitted.

You do, actually, if you've setup the git repository correctly. https://git-scm.com/book/en/v2/Customizing-Git-Git-Hooks Check out the pre-push, pre-receive, update, and post-update hooks.

Those hooks aren't tracked in the repo though, are they? In many cases that will be inconvenient.

They're placed in the repo itself, under .git/hooks, rather than in the working tree. If you want to version them, you can always place a symlink in .git/hooks and have it point to a file inside the working tree. Note that this won't work for bare repositories (which have no working tree), but usually in that case you want a separate deploy process where a sysadmin (or build script) manually copies over files, to prevent a random dev from borking the repository, which a bad update hook can easily do.

(This doesn't help with the GitHub case. But then, as we saw from the recent CocoaPods story, using GitHub as your CDN is probably not a great idea either.)

Re: I've Just Liberated My Modules

#769

Post by jhall1468 »

biot wrote: post #523
jhall1468 wrote: post #440

Earlier quoted context omitted.

That is not how trademarks work. Feel free to start the Google Paper Co. Uniqueness is not a merit for trademark infringement. To infringe you have to be a competitor.

That is how some trademarks work. Google is by now a famous mark and, as such, gets additional protection beyond what mere mortal companies do: http://itlaw.wikia.com/wiki/Famous_marks I guarantee you won't last long if you start a Coca-Cola School of Hairdressing, even though the beverage company doesn't compete for that business.

Famous and "Unique" aren't the same thing. I was responding to the theory that because "Google" is a made-up word, they'll receive extra protections. That's false. That said my example was a bad one, since Google is a famous mark Google Paper Co. would likely be infringement.

Feel free to start Kik Paper Co, however.

Re: I've Just Liberated My Modules

#770

Post by takno »

Klathmon wrote: post #675
takno wrote: post #621

Earlier quoted context omitted.

I wasn't planning on passing a non-string to my function. The type-checking only needs to happen because this is a needlessly generic function

Okay, but then when you pass a string that's just `12` in and get `16` instead of ` 12` don't blame javascript...

I didn't intend to, although since I was going to prepend a string to the start that would be a rather surprising result
Post reply on HN