141–150 of 236 posts
To partially mitigate this issue, I scope all private packages to @corp-internal/ , then use a .npmrc directive to push all packages in @corp-internal/ to packagecloud.io. The @corp/ scope is used for open source packages, @corp-internal scope does not exist on the public npm registry so no chance of config issues causing mistaken pushes.
What stops someone from creating that account and owning that org?
Earlier quoted context omitted.
> If you don't have a license from the copyright holder, you can't legally use it, except for fair use exemptions: perhaps you could write a blog post criticizing it.
Theres nuance though, that copypasting a previous comment doesn't answer. What about public domain works for example? Or you had a good faith belief you had permission from the copyright holder, eg someone misrepresented themselves as the copyright holder, or the copyright holder published the code in public without a copyright notice?
Good faith: that may affect the amount of damages the copyright holder can extract, but it's still illegal to use the software.
Copyright notices: haven't been required for 30 years.
"Ignorance" is not having knowledge about a certain field. Everyone has it. "Stupidity" is having ignorance about a field but pretending not to. These lawyers may have 7 years of law school education, but they are still "stupid".
Slightly off topic, but my experience with lawyers and technology has been mostly discouraging. For example, one lawyer wanted to sue a client of ours for using an open-source JS dropdown menu that we were also using--he said they stole our code. He was also concerned that we were letting people 'View Source' our web pages and stealing our IP.
Earlier quoted context omitted.
Please don't think this way. This is such a solvable problem. Doesn't package.json have an is private repo flag? Why not just respect that? Why does everyone everyone in this thread think a pop up is the solution? Pop ups are a code smell. They mean your application does not correctly match user intent with the action so badly you had to specifically get your user to tell you what they meant to do. Did you mean to do…
I disagree, there have been times a well-placed popup stopped me from accidentally doing something really stupid, other times there wasn't a popup and I ended up doing something stupid. It doesn't necessarily have to be a pop up popup per say, but extra validation around dangerous actions is user friendly. And of course there can always be an override for the extra validation in case it potentially screws up some peo…
I don't think a popup solving a problem means it is solving the right problem in the right way.
Earlier quoted context omitted.
No. The Bank's intent is what matters, not the intent or actions of a single employee.
At some point the corporation needs to take responsibility for what its actors do... You can't just say everything good that happens is because the corp is awesome and everything bad that happens is because that one guy did something stupid so it's all his fault and the corp is still awesome.
Still, that doesn't mean they can be bound by a license granted by an unauthorized employee. I think at most they would have to pay damages, if any.
This really isn't news, folks. It happens every week. I was just grumpy this morning.
If this happens often, perhaps the user interface for npm publish needs to change? I mean, that's the only thing I can see mitigating this, with like a nice dialog that says "hey, are you REALLY REALLY sure and have you consulted lawyers on this???" Or something to that effect. Or maybe companies can just pony up for NPM Enterprise which fits their use case.
This really isn't news, folks. It happens every week. I was just grumpy this morning.
If this happens often, perhaps the user interface for npm publish needs to change? I mean, that's the only thing I can see mitigating this, with like a nice dialog that says "hey, are you REALLY REALLY sure and have you consulted lawyers on this???" Or something to that effect. Or maybe companies can just pony up for NPM Enterprise which fits their use case.
> "it looks like your package might have a private key in file xyz.js on line 27. Please type "no it doesn't" into the box below if you're sure this is not the case".
Earlier quoted context omitted.
You would think so, but perhaps they didn't have the credentials.
They never contacted a human at npm, they just went straight over their heads.