Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kik, left-pad, and npm

blog.npmjs.org

Post reply on HN
Print view View original

1–10 of 32 posts

Re: Kik, left-pad, and npm

#3

Post by sigmar »

I like to support people that do things to convey their opinion and protest a decision. Sometimes brazen behavior is warranted to get more attention to your cause. But not in this situation. What Azer did seems like a "knee-jerk reaction" performed mostly out of spite.

Re: Kik, left-pad, and npm

#4

Post by deciplex »

> npm won’t suddenly take your package name.

"...unless we do, in which case we will."

I wonder at the cognitive dissonance that has to be there to type a thing like this when the entire shit show started with you doing exactly what you're saying you won't do.

Re: Kik, left-pad, and npm

#6

Post by ahuth »

deciplex wrote: post #4

> npm won’t suddenly take your package name. "...unless we do, in which case we will." I wonder at the cognitive dissonance that has to be there to type a thing like this when the entire shit show started with you doing exactly what you're saying you won't do.

I'm not completely up to speed on the situation. Do we know that this happened suddenly?

Re: Kik, left-pad, and npm

#7

Post by bastawhiz »

Claiming that users would be confused when installing the Kik package is a bit of a bad excuse. Installing a package without knowing what it is or does is simply nonsensical. There's no way of knowing even _how to use_ the package without looking up information about it beforehand. Anyone seriously installing a software package using a developer tool without knowing anything other than the package's name is a fool.

Additionally, the lawyers in question did not seem to want to put a new package online, they simply wanted to take down the existing one. This does not seem to be the intent of the name resolution policy.

This was a bad call on the part of the NPM team, and they should reevaluate how they arbitrate these issues.

Re: Kik, left-pad, and npm

#8

Post by deciplex »

ahuth wrote: post #6
deciplex wrote: post #4

> npm won’t suddenly take your package name. "...unless we do, in which case we will." I wonder at the cognitive dissonance that has to be there to type a thing like this when the entire shit show started with you doing exactly what you're saying you won't do.

I'm not completely up to speed on the situation. Do we know that this happened suddenly?

Based on the chats here:

https://medium.com/@mproberts/a-discussion-about-the-breakin...

It does seem that the first contact from NPM to Azer was to tell him they were taking his package. There does seem to be a gap there, so maybe there is more to it.

Re: Kik, left-pad, and npm

#9

Post by bsimpson »

bastawhiz wrote: post #7

Claiming that users would be confused when installing the Kik package is a bit of a bad excuse. Installing a package without knowing what it is or does is simply nonsensical. There's no way of knowing even _how to use_ the package without looking up information about it beforehand. Anyone seriously installing a software package using a developer tool without knowing anything other than the package's name is a fool. A…

Kik (the company) wanted to publish an npm module using their trademarked company name[1]. As has long been npm's policy, they asked the trademark holder and the author to work it out amicably. Azer handled the situation about as gracefully as you'd expect from someone who published a module without checking if the name was clear and rage-quit when that decision bit him, bitching about "corporations" and stranding the countless developers who (eventually) depended on one of his modules.

npm and Kik did most-everything right. The problem was in unpublishing already published tags. Once a tag is published, it shouldn't be able to be unpublished except in the most extenuating circumstances (perhaps a brand-new tag that inadvertently included PII). After a name changes hands, the new owner shouldn't be able to publish a new build in any of the major versions the previous owner tagged. Moreover, wholesale unpublishing modules shouldn't be allowed for the exact reasons this incident demonstrated. Based on npm's response, it sounds like they've learned that.

[1]: https://medium.com/@mproberts/a-discussion-about-the-breakin...

Post reply on HN