If your project use the packages in the list, and got broken due to this.
Here comes a solution https://medium.com/@viktorw/how-to-fix-npm-issues-in-your-pr...
I've Just Liberated My Modules
811–820 of 827 posts
Re: I've Just Liberated My Modules
#812Earlier quoted context omitted.
Signing using private key?
There is no need to sign. Just keep a cryptographic hash (SHA256 is a good bet) of the package in the dependencies manifest, and check it after download. Using a git repository gives you that for free.
More for new versions of same software where the account might be highjacked but hopefully the key wasnt. I dont think a hash would help.
Re: I've Just Liberated My Modules
#813Earlier quoted context omitted.
I agree that NPM needs to push namespacing much harder, as that would make the whole process much easier. Also a "provides" field could go a long way into stopping issues like this. Allow packages to say that they provide a package in them that is compatible with another in these version ranges. That would let "API compatible" packages be dropped in to replace even deeply nested packages easily, and would allow easy…
This will become easier with rollup, webpack@2, and so on, which can effectively reduce the penalty of including large modules like lodash by tree-shaking out all of the parts you don't use. I would expect many more utility libraries to then be aggregated into a single package/repo and for users to simply pick and choose functions at will.
Webpack 2 and Rollup don't support tree-shaking with Lodash yet. You'll need to use https://www.npmjs.com/package/babel-plugin-lodash.
Re: I've Just Liberated My Modules
#814Earlier quoted context omitted.
Underscore/lodash is a great bundle of functions that do simple things well. And it's a tiny enough library that there is really no need to split it into 270 modules. I support packages of utility functions. Distributing them individually is a waste of resources when you have tree shaking. I trust a dependency on lodash. I don't trust a dependency on a single 17 line function.
While I agree with you, tree shaking is relatively new in the JavaScript world thanks to Webpack 2 and Rollup.js before that, if you had a dependency you brought it's whole lib into your project whether you used one method or all of them. So just including Lodash wasn't an option for people who cared about loading times for their users. A 17 line module was.
Lodash has been modular since 2013.
Re: I've Just Liberated My Modules
#815Why don't people just use lodash? https://lodash.com/docs#padStart It's well-tested, well-maintained, performant, with good documentation and has custom-build to leave out functions you don't need.
And when a lodash (trademark holding) company knock the door and sey "hey, you cant use lodash anymore", what happen then? Will npm remove it or replace it?
If there was ever an issue I'd work with npm to come to a resolution that didn't break 25% of npm.
Re: I've Just Liberated My Modules
#816Hi everyone, please read this explanation from Kik's head of messenger about how this played out: https://medium.com/@mproberts/a-discussion-about-the-breakin... We're sorry for our part in creating the impression that this was anything more than a polite request to use the Kik package name for an upcoming open source project.
s/polite request/politely-worded threat/
Re: I've Just Liberated My Modules
#817Earlier quoted context omitted.
"According to Kik Interactive, as of December 2015, Kik Messenger had approximately 240 million registered users, and was used by approximately 40 percent of United States teenagers." https://en.wikipedia.org/wiki/Kik_Messenger Are you sure a court wouldn't consider that qualifying as a famous mark? I'm not going to dig into case law, but my guess is it very well could be. "Evidence relevant to the fame of a trademar…
> Are you sure a court wouldn't consider that qualifying as a famous mark? I'm not going to dig into case law, but my guess is it very well could be. Teenagers represent 9.5% of the US population meaning that 3.8% of the US population (using their 40% figure) have "used" their app. Alternatively the 240 million registered users would imply about 3.5% of the total global population has used it. I can say that I honest…
I don't know whether you're right or not, but I do know it isn't prudent to have ZERO doubt about anything - but especially legal matters - without first doing the relevant research. And even then, courts disagree all the time, so I can't imagine ever being 100% certain that a ruling would never go a certain way.
To be even reasonably certain in this case, I would need case law of similarly well-known brands being challenged. Do you have some? Capturing 40% of their target market seems pretty well known to me, but again, that's meaningless without the case law.
Re: I've Just Liberated My Modules
#818The fact that this is possible with NPM seems really dangerous. The author unpublished (erm, "liberated") over 250 NPM modules, making those global names (e.g. "map", "alert", "iframe", "subscription", etc) available for anyone to register and replace with any code they wish. Since these libs are now baked into various package.json configuration files (some with 10s of thousands of installs per month, "left-pad" with…
This is extremely severe. Any package i install might after x levels of sub-dependencies pull in one of these names which are potentially pwned. React and Babel pulled in a few of them to take some well known examples.
I would say the whole npm is pwned until these packages are either restored or that the package name is blacklisted/reserved. Is it possible to blacklist packages locally so I get warned if they are pulled in as sub dependencies? I don't trust every package maintainer to be quick enough to remove these dependencies.
Re: I've Just Liberated My Modules
#819Earlier quoted context omitted.
I for one wholeheartedly support him. The more collateral damage he causes, the more people are awareness he raises. While the solution to his problem is unclear at this point, it'll at least get us talking, and find out what all of the stakeholders can do better next time, and we as a community to prevent this from ever happening again. I entirely supports his actions.
"awareness". Awareness of what? His trademark infringement? Imagine this from the perspective of a hypothetical user. He's cranky and on a tight deadline, and suddenly his project is broken because some dumb dependency three layers away that he's never even heard of broke because some guy decided to throw a tantrum, and now his software is broken and he has to emergency rewrite part of it. All because this guy didn't…
Awareness of how fragile npm is, both in terms of trusting it to always be available for your deploy but also on the mutability of packages there. What if someone unpublished one single well used package and someone else snapped it up to publish malicious code, it could have taken months before somebody noticed.
Re: I've Just Liberated My Modules
#820Extremely dick move on behalf of the developer. Why would you remove modules that other people are using in production? Did you think a small team like NPM would go head to head with a company having full time lawyers? And for what?
He was threatened by lawyers the real assholes are Kik for taking hiring lawyers to ask him to rename his module