Abused the DMCA also. SMH.
[deleted]
Major bank accidentally published a private package to the public NPM Registry
41–50 of 236 posts
Re: Major bank accidentally published a private package to the public NPM Registry
#42Is there a thing that's like "by using this service you put your work in the public domain" kinda thing?
No, npm only says you give them a license to allow them to serve the package to users; other than that, you're free to license it however you want.
So the bank shouldn't be able to send DMCA takedown notices, right? Because they granted npm the license to redistribute the package.
Re: Major bank accidentally published a private package to the public NPM Registry
#43Is there a thing that's like "by using this service you put your work in the public domain" kinda thing?
No one would use such a thing. Very few open source code is in the public domain. The only one I can think of off the top of my head is SQLite.
Re: Major bank accidentally published a private package to the public NPM Registry
#44Earlier quoted context omitted.
How much of them sending takedown notices was a desperate posturing of "omg please please please please don't use our code!!!" I can't possibly see how they would possibly have any case.
If their code is proprietary, no one can use it. Even if they accidentally uploaded it to a public site.
> If their code is proprietary, no one can use it. Even if they accidentally uploaded it to a public site.
Surely this depends on the terms under which they uploaded it. I would expect npm to have a legal structure in place under which code you upload for public use is also licensed for public use.
Re: Major bank accidentally published a private package to the public NPM Registry
#45I hate how there's no official way to run your own private NPM registry. So you have to either pay NPM or resort to third party solutions like verdaccio. It's such an obvious money grab by the NPM devs.
Just put the package in a git repo like Github and point to it w/ package.json
EDIT - I see what you are saying - your own registry with browser and all.
Re: Major bank accidentally published a private package to the public NPM Registry
#46I hate how there's no official way to run your own private NPM registry. So you have to either pay NPM or resort to third party solutions like verdaccio. It's such an obvious money grab by the NPM devs.
They're running a business. They offer an inordinate amount of service totally free to millions of developers, and they make their actual client open-source for your pleasure. Is your argument they also have to go to the trouble of making their infrastructure easily self-hosted? How would they make the money to pay the lawyers to respond to the very legal threat this tweet is about without revenue?
Please, it's arbitrary to run a private PyPi repository, all you need is a web server and a certain folder structure. If you want, you can even host everything on a private S3 and use a tiny Nginx configuration to authenticate the requests on behalf of pip [1].
Private npm repositories are an entirely different beast, and like GP mentions, there is no great option here.
Re: Major bank accidentally published a private package to the public NPM Registry
#47Earlier quoted context omitted.
Absolutely not true. Anyone that lives in a country whose legal system does not respect their copyright can use it.
And if it's protected as a "trade secret" and not a copyright (or patent) then you probably can use it without question.
Software is copyrighted "by default". You don't need to apply for copyright like you would need to do with a patent.
Re: Major bank accidentally published a private package to the public NPM Registry
#48Earlier quoted context omitted.
Thats only true for the US and the countries adhering to US copyright. It's not universally true
It's not "US copyright", it's several international copyright treaties, which 90% of all nations have agreed to: https://en.m.wikipedia.org/wiki/Berne_Convention The few exceptions are where copyright essentially doesn't exist at all. Where it does, this is how it works.
As someone above posted the wider "List of parties to international copyright agreements", this is one of the boxes that need to be ticked prior to signing any form of deal between countries. It's a kind of 'fundamental' in order to start doing business with that country (or for the country to be taken seriously).
Re: Major bank accidentally published a private package to the public NPM Registry
#49Earlier quoted context omitted.
How would you prefer free software be funded? :-P
We are a little tounge in cheek here, but I’ll take this question seriously. While it is great that NPM can develop new and more reliable products, is would also greatly benefit them and everyone else, if enerprises of certain size or stature would be required, legaly or regutoraly, to pay for software they already use. So say you are a bank, and there is a list of regulations that you have to comply with, so here is…
As mentioned already, it wasn't that long ago when big corps like banks didn't touch open source or free stuff with a stick. People who worked at those big banks, companies like Oracle, etc, back then will be able to tell you that almost everything was built in-house.
The problem NPM solves isn't a particularly interesting or challenging problem to solve if you don't try to solve it at scale. They'd just build their own. Then for the couple of packages that are hard to replicate, they'd find a way to sign some papers to get access to the code and push it to their own registry. For everything else they'd just rewrite it from scratch. Short of things like React, it's not all that hard for places with the resources of these big corps to rewrite bundlers, web servers, and utility libraries.
Re: Major bank accidentally published a private package to the public NPM Registry
#50Which bank?