I've Just Liberated My Modules • Hacker News Board

Re: I've Just Liberated My Modules

#171

Post by pygy_ » Wed, Mar 23, 2016, 1:01 AM UTC

_puk wrote: post #107

profmonocle wrote: post #44

Earlier quoted context omitted.

Did they? Most open source licenses aren't revokable - you don't have to stop distributing the code just because the author asks you to stop. That seems especially true in this case, considering the author chose[1] to license left-pad under the WTFPL[2]. I'd say re-publishing the package counts as NPM doing "whatever the f * they want" with the code. [1] https://github.com/azer/left-pad/blob/master/package.json [2] h…

Presumably, if the original author had changed the licence and pushed to npm prior to change of ownership then npm wouldn't have been able to do this? Sounds like we could start seeing npm specific releases with different licences to the github repo (or npm specific branches with different licencing) Obviously npm could re-publish the non npm specific code, but that would be more manual than a simple revert of an unp…

Even if Azer had relicensed the code, NPM had a copy of the code released under the original one, which can't be revoked.

Re: I've Just Liberated My Modules

#172

Post by cammsaul » Wed, Mar 23, 2016, 1:01 AM UTC

There's a PR open to remove "unpublish" from NPM here:

https://github.com/npm/npm/pull/12017

Re: I've Just Liberated My Modules

#173

Post by callmevlad » Wed, Mar 23, 2016, 1:02 AM UTC

_nfin wrote: post #130

callmevlad wrote: post #43

The fact that this is possible with NPM seems really dangerous. The author unpublished (erm, "liberated") over 250 NPM modules, making those global names (e.g. "map", "alert", "iframe", "subscription", etc) available for anyone to register and replace with any code they wish. Since these libs are now baked into various package.json configuration files (some with 10s of thousands of installs per month, "left-pad" with…

So we need gpg signed packages :> And... all packages should be namespaced under the author who published them. And... I kind of want to say "once it's published, it's forever".

Looks like the npm team will not be removing the ability to unpublish packages - see reply by core committer "othiym23" on https://github.com/npm/npm/pull/12017

Re: I've Just Liberated My Modules

#174

Post by [deleted] » Wed, Mar 23, 2016, 1:02 AM UTC

seanp2k2 wrote: post #79

bentlegen wrote: post #58

Earlier quoted context omitted.

Unless you're npm: https://twitter.com/seldo/status/712414400808755200

ooh gosh, they should really do something like ban new projects from using those names until they figure out a better solution, hopefully with the module author.

[deleted]

Re: I've Just Liberated My Modules

#175

Post by repn001 » Wed, Mar 23, 2016, 1:02 AM UTC

Not a Package Manager (NPM)

Re: I've Just Liberated My Modules

#176

Post by jahewson » Wed, Mar 23, 2016, 1:03 AM UTC

jwiley wrote: post #123

I think that unfortunately this was a foregone conclusion. Copyright law, like most other laws in our society, favor corporate interests. I support his stand on principal, however. Azer is a talented developer and has an impressive life story, and has certainly contributed more to society than a social network well know for invading children's privacy. https://medium.com/@azerbike/i-owe-my-career-to-an-iraqi-imm... h…

So, this has nothing to do with copyright law. The word "Kik" is not a creative literary work. It is a registered trademark though:

http://tmsearch.uspto.gov/bin/showfield?f=doc&state=4804:lir...

I don't think there's a problem with trademark law here, I doubt that their claim is legally enforceable against the name of an npm module, as it's pretty obviously outside the goods and services which their mark is registered for. The problem is that npm are capitulating to what I suspect is an invalid request. As is often the case, people are scared of lawyers and forget that they have rights.

Re: I've Just Liberated My Modules

#177

Post by dwg » Wed, Mar 23, 2016, 1:04 AM UTC

larkinrichards wrote: post #31

I applaud this action and while I'd like to point the finger at NPM, there's no real other method to fix historical package versions that depend on this. It is worth pointing to the silly state of NPM packages: Who decided that an external dependency was necessary for a module that is 17 lines of code? module.exports = leftpad; function leftpad (str, len, ch) { str = String(str); var i = -1; if (!ch && ch !== 0) ch =…

Having a multitude of small utilities like this is a great thing with many advantages.

It may seem simple to write leftpad, but if 1000 projects that need it all write their own version, there will be at least 2000 more software bugs out there in the wild because of it. If you think that's rediculous, you're not being realistic about the huge disparity in skill levels of industry programmers as well as the considerable rush under which many projects are done.

Also important is that every time I can use a public ally available utility instead of writing it myself, it's one less thing I have to think about. The benefit of making less decisions really adds up, saving a ton of mental capacity to focus on the more important parts of my project. Even the simplest methods require some thought to design.

I know there are disadvantages (such as what happened as the topic of this post), but there are also ways to mitigate them. As far as having many versions that all do the same thing, there is usually winners and losers over time. Because of this I believe that eventually the dependency graph shrinks overall.

Note that I wouldn't advocate creating utilities for things that are not very generalizable.

Re: I've Just Liberated My Modules

#178

Post by dublinben » Wed, Mar 23, 2016, 1:05 AM UTC

pygy_ wrote: post #88

gojomo wrote: post #49

Earlier quoted context omitted.

This is a trademark dispute, not a copyright dispute. (And since Kik the company doesn't market a product in the field of command-line programmer tools, whether they have a legitimate case is arguable.) There are other distribution architectures, both organizational and technical, which would be more resistant to IP claims, especially frivolous ones.

Trademark fields are broad AFAIK. "Digital stuff" is a single category, and both kik the messenger and azer's kik fall there.

They also require consumer confusion. I don't know how you could confuse a communications app for a javascript module.

Re: I've Just Liberated My Modules

#179

Post by kzrdude » Wed, Mar 23, 2016, 1:06 AM UTC

camwest wrote: post #96

FYI I'm the one who republished left-pad after it was unpublished. I think of it similar to letting a domain name expire. The original author removed the code and I forked it and published a new version with the same package name. The main issue was there were so many hard coded dependencies to 0.0.3 so I asked npm support if they could allow me to re-publish that version and they complied since I was now the maintai…

Obviously not your choice, but it's a problem of using 0.0.x versions; no flexibility for the crate author to push minor updates.

Re: I've Just Liberated My Modules

#180

Post by kelnos » Wed, Mar 23, 2016, 1:06 AM UTC

cyphar wrote: post #18

Seems odd that a patent lawyer is being involved in a trademark dispute. Also, given the fact that he didn't make any money off it, I severely doubt that it would ever go to court.

Trademark disputes (unlike copyright and patent disputes) are often and need not be about money. US trademark law also has a fun "use it or lose it" provision that requires trademark holders to actively defend their mark.