Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Major bank accidentally published a private package to the public NPM Registry

twitter.com

Post reply on HN
Print view View original

51–60 of 236 posts

Re: Major bank accidentally published a private package to the public NPM Registry

#51

Post by crooked-v »

thaumasiotes wrote: post #44
Mikeb85 wrote: post #8

Earlier quoted context omitted.

If their code is proprietary, no one can use it. Even if they accidentally uploaded it to a public site.

> If their code is proprietary, no one can use it. Even if they accidentally uploaded it to a public site. Surely this depends on the terms under which they uploaded it. I would expect npm to have a legal structure in place under which code you upload for public use is also licensed for public use.

> I would expect npm to have a legal structure in place under which code you upload for public use is also licensed for public use.

Not how it works. For example, see the license field here:

https://www.npmjs.com/package/unlicensed

Re: Major bank accidentally published a private package to the public NPM Registry

#52

Post by astazangasta »

orblivion wrote: post #5
ronilan wrote: post #2

Next tweet: “We sell a thing that prevents this kind of mistake ...” Just sayin.

How would you prefer free software be funded? :-P

People have enough native productivity that they are able to feed, clothe and house themselves, generate their power and treat most of their ailments with no outside inputs required. In the resulting utopia people write free software in their free time because it is fun.

Re: Major bank accidentally published a private package to the public NPM Registry

#53

Post by hkchad »

symlinkk wrote: post #32

I hate how there's no official way to run your own private NPM registry. So you have to either pay NPM or resort to third party solutions like verdaccio. It's such an obvious money grab by the NPM devs.

Whats wrong w/ nexus? https://blog.sonatype.com/using-nexus-3-as-your-repository-p... All our devs have our group repo configured as default. Any publishing is done to our private repo (via CI only) and any public package is pulled through the proxy repo, this way all packages are cached in our private repo so when npm registry goes down / someone unpublishes (which happens/ed?) our CI server doesn't die.

Re: Major bank accidentally published a private package to the public NPM Registry

#55

Post by MagicPropmaker »

ufo wrote: post #47
MagicPropmaker wrote: post #37

Earlier quoted context omitted.

And if it's protected as a "trade secret" and not a copyright (or patent) then you probably can use it without question.

Software is copyrighted "by default". You don't need to apply for copyright like you would need to do with a patent.

https://www.uspto.gov/patents-getting-started/international-...

USPTO explanation of difference between a Patent, Copyright, and Trade Secret.

Re: Major bank accidentally published a private package to the public NPM Registry

#59

Post by unethical_ban »

symlinkk wrote: post #32

I hate how there's no official way to run your own private NPM registry. So you have to either pay NPM or resort to third party solutions like verdaccio. It's such an obvious money grab by the NPM devs.

JFrog has an open-core/OSS repo for NPM, I believe.

Re: Major bank accidentally published a private package to the public NPM Registry

#60

Post by tombert »

Mikeb85 wrote: post #8
tombert wrote: post #4

Earlier quoted context omitted.

How much of them sending takedown notices was a desperate posturing of "omg please please please please don't use our code!!!" I can't possibly see how they would possibly have any case.

If their code is proprietary, no one can use it. Even if they accidentally uploaded it to a public site.

I know that, but is the issue that companies are using the code or that NPM, Cloudflare, and Amazon are hosting the repo?
Post reply on HN