141–150 of 827 posts
Earlier quoted context omitted.
https://en.wikipedia.org/wiki/Unix_philosophy
Which is useful for binaries. Libraries, there tends to be a lot more aggregation. If this wasn't the case, you'd see libc spread over dozens and dozens of libraries like libmalloc librandom libstring libarithmetic libsocket libprocess libfilesystem libafilesystem (hey, async ops have a different api) libtime, etc.
The best part would be to learn that the claim was not valid in the first place. At the very least, having representation would provide for some wiggle room where you can have days if not weeks to resolve the issue, instead of feeling you have to take immediate action.
Azer has contributed awesome modules to the community, but such a move _obviously_ messes with a bunch of people who previously didn't trust npm, but Azer. Npm works fine. There might be issues with it, but the reason builds are failing right now is that he decided to unpublish all of them - in a move that feels very kneejerky, despite him claiming that it's the opposite. If this had been actually in the interest of…
It's the same issue we all experience, trusting people and institutions and finding out that that sometimes that trust can be violated.
Earlier quoted context omitted.
Yes, but I can publish an evil left-pad@0.0.10, and if you're not shrinkwrapping or any sub-dependency has left-pad: "^0.0.3", it will pull in the evil 0.0.10 version. EDIT: I stand corrected. See below, looks that's not the case specifically for "0.0.x" versions, but gets progressively more relaxed if there's a non-zero minor version specified. However, many of the unpublished packages had varying major and minor ve…
No it won't... The caret specifier for 0.0.x packages means "this version and this version exactly ".
So what keeps Kik from going after Github? https://github.com/starters/kik
Not sure I follow this completely... You start a project with the same name as a company, which owns the registered brand and are surprised when some 3rd party complies with legal suggestions to make an adjustment? Seems kind of silly to expect that NPM would want to fight for your project name when you didn't seem to do your own due diligence when picking a name. Also, a bit backwards to go remove all your modules a…
a) from what I understand, his project was there first. b) NPM shouldn't have to fight it unless they are requested to, the trademark claim was ridiculous to begin with. Regardless of the claim, enforcing it would have taken years... I'm not saying NPM shouldn't have comply with the request and rename the package but definitely could/should have handled this better. c) the guy wrote: "NPM is no longer a place that I’…
(I suspect, though, that NPM might have some legal liability, and Kik [the company] could sue them regardless, which would suck for them.)
Earlier quoted context omitted.
> You're completely missing his point if you think this suggestion is at all reasonable. Is this the kik we're talking about? http://dev.kik.com/ https://trademarks.justia.com/858/93/kik-85893307.html Is the point that kik should just give up on their company trademark?
Just because they've trademarked "kik" doesn't give them complete control over all instances of that 3 letter string in the world. See the 8 factors of trademark infringement, and trademark law in general; this is just a kik lawyer being threat happy.
Agreed - hence why I looked up the actual trademark in the first place. I wasn't expecting to find out they were in the software development business too.
> See the 8 factors of trademark infringement
I'm assuming these? (Google turned up 1 hit - which in turn was 404ed - for "8 factors of trademark infringement") http://www.bitlaw.com/trademark/infringe.html#factors
Keeping in mind IANAL:
1. The marks appear very similar, with the possible exception that kik the company appears to have no meaning behind "kik". Similar enough that I have to specify "kik the company." 2. Both appear to provide services aimed at developers. 3. The plaintiff's mark appears to be strong enough to fill the first page of Google, and for overprotective parents to overreact to. 4. I was momentarily confused which kik I was clicking through to at least once.
Am I misweighing or misinterpreting things to think that the first 3 points, at least, point towards infringement? Do you agree that these appear to be among the more important ones?
"The first five of these factors are examined in every trademark infringement action." "Of these eight factors, the first two are arguable the most important."
> ... and trademark law in general
If you have any recommendations, feel free to share.
Earlier quoted context omitted.
I'm using npm / browserify etc in anger for the first time today. This is a horrible issue to have run into and it's left a pretty sour taste. The fact that it's possible for someone to unpublish 17 lines of js and break the install of major bits of infrastructure for everybody is pretty insane. It seems like at a minimum the dependency tree should be traversed to see what the flow on effect will be. Should it even b…
I don't want to sound like a old grumpy man but here goes anyhow. I was looking into using node.js, react, etc after many years of writing web apps using Python and Quixote (obscure web framework like Flask). The whole Javascript technology stack looks pretty insane of me. Getting a working React environment requires a huge number of packages to be pulled down by npm. Browserify requires a bunch more. Recursive depen…
If NPM wants to stay relevant and a serious contender, they need to have more clear policies in case of IP issues. In this case, the companies weren't even in the same space. Republishing someone's package who has chosen to unpublish and leave your platform is akin to Facebook resurrecting a Facebook profile because they had a lot of friends and the social circle ripple effects would be too high for feed quality for…
> We need an open source NPM alternative, yesterday. NPM is open source.[1] You don't want an open source NPM, you want a distributed consensus NPM where nobody has absolute power to censor or destroy other peoples work. It seems like a prime use case for a DHT, possibly with some blockchain functionality identifying ownership of namespaces that people can reserve, like namecoin. [1]: https://github.com/npm/npm
Earlier quoted context omitted.
That's not how it works. You can't publish left-pad 0.0.3 again.
Yes, but I can publish an evil left-pad@0.0.10, and if you're not shrinkwrapping or any sub-dependency has left-pad: "^0.0.3", it will pull in the evil 0.0.10 version. EDIT: I stand corrected. See below, looks that's not the case specifically for "0.0.x" versions, but gets progressively more relaxed if there's a non-zero minor version specified. However, many of the unpublished packages had varying major and minor ve…
Proposal: go with a java based naming system: com.yc.mymodule.
All installations would require the user to use com.yc.* in package.json and all users would be required to register as a com.yc style organization name. Thus only one user can remove/add that exact module.