Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A notable JavaScript developer shamelessly copied one of my most downloaded nod

twitter.com

Post reply on HN
Print view View original

131–140 of 309 posts

Re: A notable JavaScript developer shamelessly copied one of my most downloaded nod

#131

Post by klyrs »

mmastrac wrote: post #88
gcr wrote: post #80

Earlier quoted context omitted.

You're forgetting the fact that he also went out of his way to strip the git history at first.

I clarified the comment a bit -- I considered that attribution-stripping, but I think you're right that it's more than just that. Tangentially: it's somewhat interesting that we don't consider the source code history in our OSS licenses...

FWIW, I don't see anything wrong with stripping the git history. I think it's stupid and short-sighted, but whatever, it's allowed. One use case I've seen, sometimes you want to pull a single file from another project without a bunch of baggage.

Your license should cover the history, in that every source file should bear a license header, going back to the first commit.

Re: A notable JavaScript developer shamelessly copied one of my most downloaded nod

#132

Post by ec109685 »

caslon wrote: post #8
linkdd wrote: post #6

Earlier quoted context omitted.

I was going to say this. IIRC, the MIT license does not require attribution (EDIT: it does) Most people do not understand the philosophy of Open Source. It's not "hey look at me, I made this, look at me". They should not give liberties to other people if they don't want them to use it. EDIT: Seeing the comments to this one, this should be seen as a proof of Cunningham's Law[1] [1] - https://meta.wikimedia.org/wiki/Cu…

It's literally three lines of actual content. It would not take you long to read it. The MIT License (MIT) Copyright © 2021 Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, an…

They aren’t using the commit you referenced. Instead they went down this path where there is one license, with one copyright (new author), but they are citing the other work in the copyrights: https://github.com/ai/nanocolors/pull/15/commits/182c767583b...

Re: A notable JavaScript developer shamelessly copied one of my most downloaded nod

#133

Post by diroussel »

tomxor wrote: post #102
ctvo wrote: post #94

Earlier quoted context omitted.

The absolutely crazy thing is the person who caused this doesn't even think they did anything wrong: https://github.com/babel/babel/pull/13783#issuecomment-92724... And there are people supporting their position. I think because JS is such a large tent, there are folks not familiar with licenses and general norms in this space. I don't think it's something that being reasonable and pointing things out wouldn't fix. A…

> I think because JS is such a large tent, there are folks not familiar with licenses and general norms in this space. It's worth pointing out that this is all about a bunch of packages that decorate strings with ANSI colour escape sequences... I'm not saying it's worthless, or that there is nothing wrong in principle - but it's a lot of noise over something easily replicable from scratch - something simple enough th…

There can be a lot of value in value in a code base such as this. Just copy an existing open source lib, add a small speed up, push for fast adoption across common OS build tools, now you can sell committer rights for a high price to anyone wanting to launch a supply chain attack. Could be very profitable.

This is of course unlikely to be ai’s motivation. I just wanted to present a count point to the argument that such modules have low value.

Re: A notable JavaScript developer shamelessly copied one of my most downloaded nod

#134

Post by Bobylonian »

d3nj4l wrote: post #73

I keep thinking about this event and it seems like a fractal of bizarre phenomena. The act of stripping git history and attribution while forking is itself malicious, but then aggressively creating pull requests across major projects to use the new version and rack up your download count (???), then picking petty fights with the creator of the original over attribution (????), and the fanbase (?????) of the forker do…

Arguments of other side explains a lot:

https://twitter.com/PostCSS/status/1441734989490446336

https://twitter.com/sitnikcode/status/1441878805337935877

Re: A notable JavaScript developer shamelessly copied one of my most downloaded nod

#135

Post by ghoward »

mmastrac wrote: post #88
gcr wrote: post #80

Earlier quoted context omitted.

You're forgetting the fact that he also went out of his way to strip the git history at first.

I clarified the comment a bit -- I considered that attribution-stripping, but I think you're right that it's more than just that. Tangentially: it's somewhat interesting that we don't consider the source code history in our OSS licenses...

> Tangentially: it's somewhat interesting that we don't consider the source code history in our OSS licenses...

IIUC, IANAL, we don't have to worry about it.

Versions of software can have different licenses, and the license for each version is the license that the repo was under when that version was committed.

As far as I know, if you replace every instance of "version" in the previous paragraph with "commit", it still applies.

I think this means that every commit is under a specific license, and therefore, the entire history is under one or more licenses.

Re: A notable JavaScript developer shamelessly copied one of my most downloaded nod

#136

Post by tzs »

rafaelturk wrote: post #117
Otek wrote: post #27

He literally took his project and branded as his. https://github.com/ai/nanocolors/commits/main?after=566a49b0... Disgusting.

We'll thats legal, and that's all about it when using MIT.

I wouldn't be so sure of that. Most of the world's copyright laws follow the Berne Convention, which in addition to the economic rights that US copyright law provides also provides "moral" rights including the right of attribution.

The US sort of half-heartedly added moral rights about 30 years ago in order to join Berne, but they are limited mostly to works of visual arts and would not apply to code.

They are not so limited in most of the rest of the world. Furthermore in much of the world (such as most of Europe) an author cannot waive or assign their moral rights and so any license term that purports to do so would be invalid in those places.

Even if I was the kind of person who would want to misattribute someone else's work as my own, unless I was very very sure that I only had to worry about US copyright law I would tread very carefully.

Re: A notable JavaScript developer shamelessly copied one of my most downloaded nod

#137

Post by tomxor »

diroussel wrote: post #133
tomxor wrote: post #102

Earlier quoted context omitted.

> I think because JS is such a large tent, there are folks not familiar with licenses and general norms in this space. It's worth pointing out that this is all about a bunch of packages that decorate strings with ANSI colour escape sequences... I'm not saying it's worthless, or that there is nothing wrong in principle - but it's a lot of noise over something easily replicable from scratch - something simple enough th…

There can be a lot of value in value in a code base such as this. Just copy an existing open source lib, add a small speed up, push for fast adoption across common OS build tools, now you can sell committer rights for a high price to anyone wanting to launch a supply chain attack. Could be very profitable. This is of course unlikely to be ai’s motivation. I just wanted to present a count point to the argument that su…

Very true, this is a reason i'm trying to distance myself from the NPM ecosystem actually... It's a cultural problem as much as a technical one, and it is ripe for exploitation... In combination with some of the NPM CVEs revealed in the past, it's pretty scary the reach and potential a single NPM package has for destruction and exploitation... and that is before even considering packages that get included in front and back end code for the web.

Re: A notable JavaScript developer shamelessly copied one of my most downloaded nod

#138

Post by _v7gu »

judofyr wrote: post #40

What is even going on here? https://github.com/jorgebucaran/colorette/issues/78 . They're arguing about who should have attribution for adding a single "!s &&" to improve performance? What happened with the world where open-source was about creating cool projects together , not about who has the most stars on GitHub? To be honest, this is the general feeling I get from the JavaScript community: Instead of working tog…

Holy shit that guy looks insufferable. At this point having PostCSS as a dependency just looks like a liability

Re: A notable JavaScript developer shamelessly copied one of my most downloaded nod

#139

Post by fenomas »

rafaelturk wrote: post #117
Otek wrote: post #27

He literally took his project and branded as his. https://github.com/ai/nanocolors/commits/main?after=566a49b0... Disgusting.

We'll thats legal, and that's all about it when using MIT.

MIT requires copies to retain the original copyright notice and license info.

Re: A notable JavaScript developer shamelessly copied one of my most downloaded nod

#140

Post by iaml »

ta988 wrote: post #127
tomxor wrote: post #102

Earlier quoted context omitted.

> I think because JS is such a large tent, there are folks not familiar with licenses and general norms in this space. It's worth pointing out that this is all about a bunch of packages that decorate strings with ANSI colour escape sequences... I'm not saying it's worthless, or that there is nothing wrong in principle - but it's a lot of noise over something easily replicable from scratch - something simple enough th…

I thought it was a joke your is-odd comment. But no it is at version 3.0.1 and has 2.1 million downloads a month[0]... And it has a dependency to is-number. With the performance of today's tree shaking systems I wonder why there is not a simple math lib. [0] https://www.npmjs.com/package/is-odd

> I wonder why there is not a simple math lib

This [0] might be what you are looking for, it has both is-number and is-odd.

[0] https://github.com/stdlib-js/stdlib

Post reply on HN