Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I've Just Liberated My Modules

medium.com

Post reply on HN
Print view View original

771–780 of 827 posts

Re: I've Just Liberated My Modules

#771

Post by jessaustin »

dublinben wrote: post #201
tantalor wrote: post #185

Earlier quoted context omitted.

They have the responsibility to defend their trademark, otherwise it could be abused by a rival claiming they did not adequately defend it. That said, NPM could have just said, "No, stop bothering us" and the lawyers might have backed down, satisfied their attempt to defend the trademark fulfilled their duty.

>They have the responsibility to defend their trademark This is not limited to only issuing cease and desists. Kik Interactive can offer a zero cost license for the trademark if they want to assert their ownership, but let the project continue to use their name.

Some lawyers do not favor low-conflict resolutions, and would not recommend such to their clients.

Re: I've Just Liberated My Modules

#772

Post by giancarlostoro »

r0muald wrote: post #444
giancarlostoro wrote: post #420

Earlier quoted context omitted.

I'm left thinking of how Go does it, whereby repositories are downloaded via git or whatever version control software's URL. Making it impossible for the admins of "NPM" to take down a package. Add in IPFS and you've got one heck of a "package manager" I guess Go's approach is not really a "package manager" but nobody can truly stop you from downloading from a git repository, and if they do, you can go to the forks e…

The same can happen with GitHub repositories, though, that is how the vast majority of Go packages get published. It's almost as if privately controlled, centralized archives are a bad idea.

Except Go isn't GitHub specific, I could use BitBucket, Gitlab, or any service I setup myself. Even locally, just like git itself I suppose. Go supports other tools like Mercurial as well as others.

Re: I've Just Liberated My Modules

#773

Post by jwiley »

cyphar wrote: post #435
jwiley wrote: post #123

I think that unfortunately this was a foregone conclusion. Copyright law, like most other laws in our society, favor corporate interests. I support his stand on principal, however. Azer is a talented developer and has an impressive life story, and has certainly contributed more to society than a social network well know for invading children's privacy. https://medium.com/@azerbike/i-owe-my-career-to-an-iraqi-imm... h…

Copyright law is not at all related to this. It was a trademark dispute. You might've fallen into the trap of grouping several unrelated laws into "Intellectual Property", a misnomer which confuses confusion when discussing such laws.

Good points...I threw out copyright law when trademark is the better terminology

Re: I've Just Liberated My Modules

#774

Post by jessaustin »

nostrademons wrote: post #768
jessaustin wrote: post #761

Earlier quoted context omitted.

Those hooks aren't tracked in the repo though, are they? In many cases that will be inconvenient.

They're placed in the repo itself, under .git/hooks, rather than in the working tree. If you want to version them, you can always place a symlink in .git/hooks and have it point to a file inside the working tree. Note that this won't work for bare repositories (which have no working tree), but usually in that case you want a separate deploy process where a sysadmin (or build script) manually copies over files, to pre…

Well, sure, but that's complicated, and ".scripts.prepublish" in package.json is not. I'd love to have the git knowledge to do what you've described here without googling and frowning, but I don't have that yet, and I've been using git for years. Whereas I could use package.json to accomplish the same task on basically the first day I used npm.

Re: I've Just Liberated My Modules

#776

Post by simison »

esquivalience wrote: post #708
jonathankoren wrote: post #372

Earlier quoted context omitted.

> I noticed that NPM Inc. didn't unpublish his module, but transfered the name to another account, which is much worse, if you think about it. Jesus. This is a disaster. At this point, the only responsible thing to do is to avoid NPM.

I feel like the best way to avoid a disaster like this is for developers to avoid using registered brand names when they write their packages. It's not difficult, since there are all sorts of rights brand owners can't get you on. 1. You don't really need a catchy name for an open source project, since you're not in competition for funds. Call it something descriptive. Descriptive words can't usually be protected, so…

...and do the same for the 200+ or so independent countries in the world with their own databases?

You, my friend, are being US biased.

Re: I've Just Liberated My Modules

#777

Post by fixermark »

naasking wrote: post #655
tangus wrote: post #586

Earlier quoted context omitted.

Pay damages, then.

Pay damages because someone else uploaded something by accident and you can't fix it? It doesn't work like that.

It only doesn't work like that in the context of safe harbor laws.

If the safe harbor law protection doesn't apply, and the defendant is responsible for the illegal behavior, the defendant can absolutely be held legally liable and pay the legally-appropriate punishment.

Re: I've Just Liberated My Modules

#778

Post by trumbitta2 »

zackboe wrote: post #759
TimJRobinson wrote: post #670

Quick script to test if your project is using any of the modules he unpublished: for module in $(curl -s https://gist.githubusercontent.com/azer/db27417ee84b5f34a6ea/raw/50ab7ef26dbde2d4ea52318a3590af78b2a21162/gistfile1.txt); do grep "\"$module\"" package.json; done If any names appear you should replace them or force that specific version always (remove ~ or ^ before it). If nothing appears you're probably good.

Snyk added a 'test-unpublished' command to check all dependencies, but "is currently limited only to the packages Azer just unpublished, as opposed to all unpublished packages." https://snyk.io/blog/testing-for-unpublished-packages/

I'm not sure node is a safe choice for such a script, given one of the dependencies (or one of the dependencies' dependencies and so on) could use one unpublished module now or at some point in the future.

That's why I chose bash for mine: https://github.com/trumbitta/kik-check

Re: I've Just Liberated My Modules

#779

Post by fapjacks »

usrusr wrote: post #566
tomaskafka wrote: post #536

Earlier quoted context omitted.

Like, can my github username be kik? And if I have created years before they founded kik?

How many years before github would that be? (Edit: this was written under the assumption that the lawyers in question are working on behalf of kik, the cheap clothes company, not kik, the messenger company. The original article is unclear about that) This really has to be attacked at the root: let's all stop pretending that a sequence of characters can be owned. Before the web came along, people were completely sane…

Ding Ding Ding!!!

Re: I've Just Liberated My Modules

#780

Post by jessaustin »

larkinrichards wrote: post #31

I applaud this action and while I'd like to point the finger at NPM, there's no real other method to fix historical package versions that depend on this. It is worth pointing to the silly state of NPM packages: Who decided that an external dependency was necessary for a module that is 17 lines of code? module.exports = leftpad; function leftpad (str, len, ch) { str = String(str); var i = -1; if (!ch && ch !== 0) ch =…

Who decided that an external dependency was necessary for a module that is 17 lines of code?

This is an advantage of language concision. In coffeescript this isn't even a function, it's just a one-line idiom:

  (ch for [0...len]).join('')[str.length..] + str
Post reply on HN