Live data from Hacker News

Major bank accidentally published a private package to the public NPM Registry

twitter.com

31–40 of 236 posts

Re: Major bank accidentally published a private package to the public NPM Registry

#31

Is there a thing that's like "by using this service you put your work in the public domain" kinda thing?

No, npm only says you give them a license to allow them to serve the package to users; other than that, you're free to license it however you want.

Re: Major bank accidentally published a private package to the public NPM Registry

#33

Abused the DMCA also. SMH.

How is this DMCA abuse? A copyright owner is requesting that a site that has safe harbor protection remove an unauthorized copyrighted work. The employee that originally created the unauthorized package may no longer work for the bank, unable to be identified, or doesn't have the credentials anymore.

Does the fact that the bank distributed the material in the first place change the situation?

Re: Major bank accidentally published a private package to the public NPM Registry

#37
post #21
post #8

Earlier quoted context omitted.

If their code is proprietary, no one can use it. Even if they accidentally uploaded it to a public site.

Absolutely not true. Anyone that lives in a country whose legal system does not respect their copyright can use it.

And if it's protected as a "trade secret" and not a copyright (or patent) then you probably can use it without question.

Re: Major bank accidentally published a private package to the public NPM Registry

#38

I hate how there's no official way to run your own private NPM registry. So you have to either pay NPM or resort to third party solutions like verdaccio. It's such an obvious money grab by the NPM devs.

They're running a business. They offer an inordinate amount of service totally free to millions of developers, and they make their actual client open-source for your pleasure. Is your argument they also have to go to the trouble of making their infrastructure easily self-hosted? How would they make the money to pay the lawyers to respond to the very legal threat this tweet is about without revenue?

Re: Major bank accidentally published a private package to the public NPM Registry

#39
post #23

Earlier quoted context omitted.

How would you prefer free software be funded? :-P

We are a little tounge in cheek here, but I’ll take this question seriously. While it is great that NPM can develop new and more reliable products, is would also greatly benefit them and everyone else, if enerprises of certain size or stature would be required, legaly or regutoraly, to pay for software they already use. So say you are a bank, and there is a list of regulations that you have to comply with, so here is…

I'm not sure we need another incentive for large companies to not use best-practices and modern technology.

Re: Major bank accidentally published a private package to the public NPM Registry

#40

I hate how there's no official way to run your own private NPM registry. So you have to either pay NPM or resort to third party solutions like verdaccio. It's such an obvious money grab by the NPM devs.

Gotta pay the bills somehow. I think that providing enterprise support is a very good way to do so. There is nothing compelling them to develop an official solution and a third-party one already exists. It looks like this is a good example of open source WAI.
Post reply on HN