Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kik, left-pad, and npm

blog.npmjs.org

Post reply on HN
Print view View original

11–20 of 32 posts

Re: Kik, left-pad, and npm

#11

Post by jsprogrammer »

Some interesting things to note:

NPM claims intellectual property issues had nothing to do with their dispute resolution.

NPM disregarded Azer's unpublish request by restoring `left-pad@0.0.3` from a backup of Azer's original publishing, not by repackaging the liberally licensed source.

NPM claims the full dispute resolution policy is still in place, yet many of the packages that have been taken over currently have no usable code and/or are being 'squatted' in direct contradiction of that policy.

Re: Kik, left-pad, and npm

#12

Post by jsprogrammer »

bsimpson wrote: post #9
bastawhiz wrote: post #7

Claiming that users would be confused when installing the Kik package is a bit of a bad excuse. Installing a package without knowing what it is or does is simply nonsensical. There's no way of knowing even _how to use_ the package without looking up information about it beforehand. Anyone seriously installing a software package using a developer tool without knowing anything other than the package's name is a fool. A…

Kik (the company) wanted to publish an npm module using their trademarked company name[1]. As has long been npm's policy, they asked the trademark holder and the author to work it out amicably. Azer handled the situation about as gracefully as you'd expect from someone who published a module without checking if the name was clear and rage-quit when that decision bit him, bitching about "corporations" and stranding th…

The problem is that KIK (the company) has no registered trademark for this use. If they had, they (or you) could point to the specific registration that the `kik` project infringed upon.

Any talk about trademarks is irrelevant (and npm even claims in this article that it had nothing to do with their decision).

Additionally, the `kik` package now has this description:

'This package name is not currently in use, but was formerly occupied by a popular package. To avoid malicious use, npm is hanging on to the package name, but loosely, and we\'ll probably give it to you if you want it.'

So...why did this happen again?

Re: Kik, left-pad, and npm

#13

Post by jsprogrammer »

deciplex wrote: post #8
ahuth wrote: post #6

Earlier quoted context omitted.

I'm not completely up to speed on the situation. Do we know that this happened suddenly?

Based on the chats here: https://medium.com/@mproberts/a-discussion-about-the-breakin... It does seem that the first contact from NPM to Azer was to tell him they were taking his package. There does seem to be a gap there, so maybe there is more to it.

The author of that post claims those transcripts represent the "complete email thread of [their] exchange", but I also have serious doubts about the accuracy of that claim.

Particularly troubling is the 'first' email from KIK|Bob to NPM:

>OK, so it doesn’t seem to be possible to resolve this amicably. Can you guys help?

>Bob Stratton

>kik Interactive

If this was a cold-email to NPM, we must assume that Bob is relying on NPM to spend time deciphering the chain mail that he had just forwarded to them.

Words like "it" and "this" suggest that their had been prior correspondence between the parties, but maybe Bob just likes to dump chain mails on other parties while using extremely vague pronouns?

Re: Kik, left-pad, and npm

#14

Post by bsimpson »

jsprogrammer wrote: post #12
bsimpson wrote: post #9

Earlier quoted context omitted.

Kik (the company) wanted to publish an npm module using their trademarked company name[1]. As has long been npm's policy, they asked the trademark holder and the author to work it out amicably. Azer handled the situation about as gracefully as you'd expect from someone who published a module without checking if the name was clear and rage-quit when that decision bit him, bitching about "corporations" and stranding th…

The problem is that KIK (the company) has no registered trademark for this use. If they had, they (or you) could point to the specific registration that the `kik` project infringed upon. Any talk about trademarks is irrelevant (and npm even claims in this article that it had nothing to do with their decision). Additionally, the `kik` package now has this description: 'This package name is not currently in use, but wa…

The first rule of open source is check if the name has any other popular uses (using, at the very least, Google and the USPTO). Whether or not Kik would have sued for trademark infringement is secondary - before publishing, the author should have searched for the name, and when he saw an established product using it, chosen something else.

npm has never been secretive about its name collision policy.

Re: Kik, left-pad, and npm

#16

Post by deciplex »

jsprogrammer wrote: post #12
bsimpson wrote: post #9

Earlier quoted context omitted.

Kik (the company) wanted to publish an npm module using their trademarked company name[1]. As has long been npm's policy, they asked the trademark holder and the author to work it out amicably. Azer handled the situation about as gracefully as you'd expect from someone who published a module without checking if the name was clear and rage-quit when that decision bit him, bitching about "corporations" and stranding th…

The problem is that KIK (the company) has no registered trademark for this use. If they had, they (or you) could point to the specific registration that the `kik` project infringed upon. Any talk about trademarks is irrelevant (and npm even claims in this article that it had nothing to do with their decision). Additionally, the `kik` package now has this description: 'This package name is not currently in use, but wa…

Wait, like to anyone who wants it? I wonder what would happen if Azer asked for it back, heh.

Re: Kik, left-pad, and npm

#17

Post by dandelany »

jsprogrammer wrote: post #12
bsimpson wrote: post #9

Earlier quoted context omitted.

Kik (the company) wanted to publish an npm module using their trademarked company name[1]. As has long been npm's policy, they asked the trademark holder and the author to work it out amicably. Azer handled the situation about as gracefully as you'd expect from someone who published a module without checking if the name was clear and rage-quit when that decision bit him, bitching about "corporations" and stranding th…

The problem is that KIK (the company) has no registered trademark for this use. If they had, they (or you) could point to the specific registration that the `kik` project infringed upon. Any talk about trademarks is irrelevant (and npm even claims in this article that it had nothing to do with their decision). Additionally, the `kik` package now has this description: 'This package name is not currently in use, but wa…

Because Kik plans to `npm publish kik`, presumably a JS API or something. That is a stock robomessage, though granted, not a very good one under the circumstances.

Re: Kik, left-pad, and npm

#18

Post by naviehuynh »

bastawhiz wrote: post #7

Claiming that users would be confused when installing the Kik package is a bit of a bad excuse. Installing a package without knowing what it is or does is simply nonsensical. There's no way of knowing even _how to use_ the package without looking up information about it beforehand. Anyone seriously installing a software package using a developer tool without knowing anything other than the package's name is a fool. A…

I've done apt-get install node on ubuntu and got a legacy package. Would you go to check if apt-get install firefox really install the browser and do it every single time you install something? It's not totally a bad excuse I think.

Re: Kik, left-pad, and npm

#20

Post by Isofarro »

bastawhiz wrote: post #7

Claiming that users would be confused when installing the Kik package is a bit of a bad excuse. Installing a package without knowing what it is or does is simply nonsensical. There's no way of knowing even _how to use_ the package without looking up information about it beforehand. Anyone seriously installing a software package using a developer tool without knowing anything other than the package's name is a fool. A…

"Anyone seriously installing a software package using a developer tool without knowing anything other than the package's name is a fool."

That includes the projects that had left-pad as a dependency.

Post reply on HN