49 ms·

I've Just Liberated My Modules

• devishard 11y ago
  Yet another example of the JavaScript ecosystem being pretty much garbage. To be clear, I'm not attacking the author here. He released left-pad at version 0.0.3; no responsible developer should be using that in production code.
• superninja 11y ago
  "This situation made me realize that NPM is someone’s private land where corporate is more powerful than the people, and I do open source because, Power To The People." This is true of all package distribution systems. There's always a small elite of admins who regard the system as their territory (and usually have no respect for the authors). People contributing should be well aware of this.
• tobltobs 11y ago
  Even if those trademarks would include a tool like kik, it is completely brainwashed to enable trademarks for three letter words and enforcing them on software packages names. What are we supposed to type for package names in 10 years. 'abshwjais_kik', or will it be hipster to use unicode like in 'κικ'.
• seldo 11y ago
  The package author decided to unpublish the package. A new author has now stepped in and re-published the package (yay open source!) and deps are fixed.
  • Arnavion 11y ago
    And the reason for unpublishing is at https://medium.com/@azerbike/i-ve-just-liberated-my-modules-9045c06be67c https://medium.com/@azerbike/i-ve-just-liberated-my-modules-...
    • binaryjohn 11y ago
      The incredible resilience/fragility of open source all in one thread: https://github.com/azer/left-pad/issues/4#issuecomment-200060983 https://github.com/azer/left-pad/issues/4#issuecomment-20006...
  • zackboe 11y ago
    NPM 'un-un-published' the needed version: https://twitter.com/seldo/status/712414400808755200 https://twitter.com/seldo/status/712414400808755200 E: Did not realize I was linking the author their own tweets.
• chejazi 11y ago
  This broke a number of builds that depended on the (previously) published modules, here's a GitHub issue showcasing that: https://github.com/azer/left-pad/issues/4 https://github.com/azer/left-pad/issues/4
  • deleted 11y ago
    [deleted]
• chvid 11y ago
  In case anyone is wondering what was in the now broken dependency - here is the source code in full: module.exports = leftpad; function leftpad (str, len, ch) { str = String(str); var i = -1; if (!ch && ch !== 0) ch = ' '; len = len - str.length; while (++i < len) { str = ch + str; } return str; } https://github.com/azer/left-pad/blob/master/index.js https://github.com/azer/left-pad/blob/master/index.js
  • andy9775 11y ago
    17 lines of JS causes so much havoc. Knew this would eventually happen, but I thought the code would have been more interesting
    • bryanrasmussen 11y ago
      the more basic the functionality the more widespread its usage.
  • aidos 11y ago
    I'm using npm / browserify etc in anger for the first time today. This is a horrible issue to have run into and it's left a pretty sour taste. The fact that it's possible for someone to unpublish 17 lines of js and break the install of major bits of infrastructure for everybody is pretty insane. It seems like at a minimum the dependency tree should be traversed to see what the flow on effect will be. Should it even be possible to revoke an old version that's depended on by other libs? These few lines of js cost me a couple of hours tonight! :-/
    • st3v3r 11y ago
      Should one not be able to unpublish? What if there's a bug in a released version, and it's going to take a while to fix? Or what if you simply no longer wish to be associated with the organization anymore?
      • steveklabnik 11y ago
• tlrobinson 11y ago
  Also: https://twitter.com/seldo/status/712414400808755200 https://twitter.com/seldo/status/712414400808755200
  • newman314 11y ago
    In all honesty, I think npm handled this whole situation poorly. I'm not excusing the dev's behavior but I take issue with npm removing the module as well as arbitrarily restoring left-pad (with the cop-out of same name, different dev) WTFPL notwithstanding. For those defending Kik's trademark, its like MS trying to trademark the word Windows. Didn't work that well for them either. https://en.wikipedia.org/wiki/Microsoft_Corp._v._Lindows.com,_Inc https://en.wikipedia.org/wiki/Microsoft_Corp._v._Lindows.com....
• cammsaul 11y ago
  Update: NPM takes "unprecidented action [...] given the severity and widespread nature of the breakage" and un-un-publishes left-pad https://twitter.com/seldo/status/712414400808755200 https://twitter.com/seldo/status/712414400808755200
  • douche 11y ago
    Seriously, it's a disgrace that Javascript has such piss-poor string handling built into it's standard library that such a thing is necessary.
    • Skywing 11y ago
      Coming in ES7!
      • douche 11y ago
        Which I might be able to use by 2020 or 2025... Enterprises are still dragging along on IE8 and 9.
  • mathetic 11y ago
    This is incredible. They screwed the author about ownership once and then they did exactly the same thing again.
    • profmonocle 11y ago
      Did they? Most open source licenses aren't revokable - you don't have to stop distributing the code just because the author asks you to stop. That seems especially true in this case, considering the author chose[1] to license left-pad under the WTFPL[2]. I'd say re-publishing the package counts as NPM doing "whatever the f* they want" with the code. [1] https://github.com/azer/left-pad/blob/master/package.json https://github.com/azer/left-pad/blob/master/package.json [2] http://www.wtfpl.net/txt/copying/ http://www.wtfpl.net/txt/copying/
      • 11y ago
• airless_bar 11y ago
  That's pretty much the worst handling of this issue I could ever imagine. Spine-less flip-flopping–because taking a stand would have been too inconvenient. What did people expect from some 20 year olds managing a centralized piece of infrastructure?
  • ch4s3 11y ago
    No, the original author didn't change his mind. The people at NPM undid his unpublishing so that peoples' builds would pass while the mess gets sorted out.
    • airless_bar 11y ago
      That's exactly what I said.
      • ch4s3 11y ago
        No it isn't. No one flip-flopped here.
  • detaro 11y ago
    What's "flip-flopping"? The package restored is not the one the trademark issues were about.
  • dang 11y ago
    Name-calling and slurs, both of which you've done here, break the HN guidelines. If you have a substantive point, please make it without stooping to these; if you don't, please don't post at all. We detached this subthread from https://news.ycombinator.com/item?id=11340768 https://news.ycombinator.com/item?id=11340768 and marked it off-topic.
• jlg23 11y ago
  Seriously? "When I started coding Kik, didn’t know there is a company with same name. And I didn’t want to let a company force me to change the name of it. After I refused them, they reached NPM’s support emphasizing their lawyer power in every single e-mail CC’ing me. I was hoping that NPM would protect me, because I always believed that NPM is a nice organization." a) Ignorance is no excuse. b) Expecting others to fight for one is lame. Either have the balls and fight or STFU. "Summary; NPM is no longer a place that I’ll share my open source work at, so, I’ve just unpublished all my modules. This is not a knee-jerk action." Wrong, that is the prototype of a knee-jerk action. Last but not least, whining about it in public in the hope "something will happen" is pathetic. What I'd suggest (though now it is too late): Rename the module to comply with legal claims, put up a new module under the old name that throws errors when called that describe the reason so developers see it and put shame on the threatening company/lawyers.
  • gnaritas 11y ago
    > Wrong, that is the prototype of a knee-jerk action. No it isn't; and he made that clear, he objects to their actions and is taking action of his own. > Last but not least, whining about it in public in the hope "something will happen" is pathetic. No, it's called protesting, and it's exactly the correct thing to do. Calling it pathetic is itself pathetic. > hat I'd suggest (though now it is too late): Rename the module to comply with legal claims, put up a new module under the old name that throws errors when called that describe the reason so developers see it and put shame on the threatening company/lawyers. You're completely missing his point if you think this suggestion is at all reasonable.
    • oldmanjay 11y ago
      He made it clear he doesn't want to consider it a knee jerk, which has approximately zero relationship to whether it actually is. Protesting trademark law sounds like a lot of useless fun. It may be the "correct" thing to do, but it will have no result.
      • st3v3r 11y ago
• st3v3r 11y ago
  Hopefully NPM will think of this in the future, next time they try something like this.
  • pluma 11y ago
    Let's remember that NPM Inc has also been toying with the idea of banning IPs associated with "bad people" for behaviour outside of NPM itself. In other words: they think it's morally justifiable to ban a company's IP address(es) from the NPM service because one of their employees said something objectionable on Twitter (not involving NPM or any of its representatives). And what should the company do if their employee gets them banned? Why, fire them of course.
    • LukeB_UK 11y ago
      Care to give a source for that claim?
      • pluma 11y ago
        Would love to but @izs deleted his tweets a couple of hours later. The entire ordeal happened back in January (I think), around the same time as some other npm drama (e.g. https://github.com/nodejs/node/issues/3959 https://github.com/nodejs/node/issues/3959 and https://github.com/nodejs/TSC/issues/21 https://github.com/nodejs/TSC/issues/21 and https://github.com/nodejs/NG/issues/26 https://github.com/nodejs/NG/issues/26, leading up to https://github.com/nodejs/NG/issues/29 https://github.com/nodejs/NG/issues/29) -- the twitter incident gets referenced in some of the comments. There are however plenty of comments by NPM representatives (including izs) that they see it as a moral obligation to uphold their CoC even beyond the scope of NPM itself (implying what izs proposed). There's a fundamental divide going on between people who think open source (code, not communities) should be attached to certain moral values and those thinking it should be agnostic of social issues. Similar to the Open Source vs Free Software divide in the 1990s. Except while the FSF was the one arguing on moral grounds before, the new movement is actually in conflict with one of the main concepts of the GPL: authors should not be able to restrict how code can be used and by whom (i.e. you can't prohibit people from using code for evil if it should be GPL compatible).
• praxulus 11y ago
  This is a surprisingly effective protest action. It got the attention of an incredible number of people very quickly, and the damage is mostly limited to wasting the time of a bunch of build cops. I don't have much of an opinion on his actual reasons for protesting, but I do think it was a pretty cool protest.
  • jlg23 11y ago
    EDIT: For those with a short attention span, the first paragraph is a drastic metaphor, the second is making my point. If a kid does not get cookies at home it can shoot all its classmates. Lots of media coverage, the kid will get "the attention of an incredible number of people very quickly". NO. For me, publishing code under a FOSS-license means giving back to the community. Anyone who then decides to cause collateral damage in that community was never in for the community in first place. Sorry, that sucks. It causes extra work to developers who rely on your code. They have to spend time to fix a non-issue. Time they could spend with friends and families. If I was a js-coder, the author would be blacklisted for life. If I was an employer, the author would not get permission to publish code created during work hours under a FOSS-license without the company having a private repo. Such a reaction actually costs real money to lots of people. And it is a great disservice to the FOSS-community because it sets a precedent.
    • celtain 11y ago
      I think you missed the caveat about the actual damage caused. Wasting people's time is nowhere close to murder.
      • jlg23 11y ago
        And I think you missed the point of my response. I chose a admittedly drastic picture to get across the point about causing collateral damage.
        • CydeWeys 11y ago
          Hyperbolic analogies don't prove points though.
• st3v3r 11y ago
  Wow, first they steal a package from the original author, then they do this. Why will anyone want to publish to NPM after this again?
  • maze-le 11y ago
    Right now I have serious doubts about the whole npm infrastructure...
• x0ner 11y ago
  Not sure I follow this completely... You start a project with the same name as a company, which owns the registered brand and are surprised when some 3rd party complies with legal suggestions to make an adjustment? Seems kind of silly to expect that NPM would want to fight for your project name when you didn't seem to do your own due diligence when picking a name. Also, a bit backwards to go remove all your modules as well, therefore breaking builds.
  • gariany 11y ago
    a) from what I understand, his project was there first. b) NPM shouldn't have to fight it unless they are requested to, the trademark claim was ridiculous to begin with. Regardless of the claim, enforcing it would have taken years... I'm not saying NPM shouldn't have comply with the request and rename the package but definitely could/should have handled this better. c) the guy wrote: "NPM is no longer a place that I’ll share my open source work at, so, I’ve just unpublished all my modules." I think it's pretty clear why we pull all of his modules.
    • steveklabnik 11y ago
      > the trademark claim was ridiculous to begin with. npm's lawyers disagree with you, and they're lawyers. EDIT: cool HN, -2 for stating a fact. Sure, I don't disagree that this lawsuit is kind of silly, but npm's laywers don't think this suit is _frivolous_, which is what matters.
      • piotrkaminski 11y ago
        Layers tend to be conservative, and have also been known to make mistakes. I don't think it's crazy to question their decisions.
      • gariany 11y ago
        3 letters of a NPM developers package? for real?? I'm pretty sure the owners of Kik wouldn't care that that developer package is named Kik. I can find 1000s of mentions of Kik online which validates the trademark. Starting from @kik on twitter to an online project of a random student. Pursuing a NPM package names?????? for real?! If you've ever worked with lawyers you would have known that they would always be on the conservative (safe) side without understand the business implications.
• cyphar 11y ago
  Seems odd that a patent lawyer is being involved in a trademark dispute. Also, given the fact that he didn't make any money off it, I severely doubt that it would ever go to court.
  • adrinavarro 11y ago
    If you ask me, I'd bet that it's because the brand behind the 'concerned' trademark is up to something and they are just doing their homework.
  • kelnos 11y ago
    Trademark disputes (unlike copyright and patent disputes) are often and need not be about money. US trademark law also has a fun "use it or lose it" provision that requires trademark holders to actively defend their mark.
• al2o3cr 11y ago
  "eventually create a truly free alternative for NPM." Which will either comply with copyright laws, or get blasted off the 'netz and break everyone's build... The rules are messed up, but dramatic gestures and abstract hopes that "free software will save us" aren't going to fix them.
  • gojomo 11y ago
    This is a trademark dispute, not a copyright dispute. (And since Kik the company doesn't market a product in the field of command-line programmer tools, whether they have a legitimate case is arguable.) There are other distribution architectures, both organizational and technical, which would be more resistant to IP claims, especially frivolous ones.
    • pygy_ 11y ago
      Trademark fields are broad AFAIK. "Digital stuff" is a single category, and both kik the messenger and azer's kik fall there.
      • dublinben 11y ago
        They also require consumer confusion. I don't know how you could confuse a communications app for a javascript module.
• felixrieseberg 11y ago
  Azer has contributed awesome modules to the community, but such a move _obviously_ messes with a bunch of people who previously didn't trust npm, but Azer. Npm works fine. There might be issues with it, but the reason builds are failing right now is that he decided to unpublish all of them - in a move that feels very kneejerky, despite him claiming that it's the opposite. If this had been actually in the interest of the community (because he thinks that npm isn't acting in our interest), he'd give people a fair warning. I could have lived with a "Hey, this was my experience, it sucked, I'll unpublish things in 30 days. Please update your dependencies." We know how to deprecate things gracefully.
  • fogleman 11y ago
    And we wouldn't be talking about it.
    • ngokevin 11y ago
      If that was his goal, to make noise, then that was a pretty "destructive" way to spark a discussion.
      • FroshKiller 11y ago
        You make a spark to set a fire, dude.
  • jsprogrammer 11y ago
    Didn't NPM break builds by completely swapping out the contents of a known module? Obviously NPM should not be relied on, but this really makes the case. NPM will arbitrarily modify packages without notice -- this could be the unwinding of NPM.
    • city41 11y ago
      You give people too much credit. The vast majority won't notice or care.
    • 11y ago
• jerf 11y ago
  This is why you should vendor it. What is "it"? All of it, whatever it may be. You should be able to build your systems without an internet connection to the outside world. I say this with no reference to particulars of your language or runtime or environment or anything else. This is merely a specific example of something that could happen to a lot of people, in a lot of languages. It's just a basic rule of professional software development.
  • Klathmon 11y ago
    I agree. I use and love NPM and others like it, but when it comes down to it, i check-in my dependencies when my applications get "released". Committing the updates is only one more step, and in my experience it's not even another step since we already have a rule that new installs or dep updates need their own commit.
    • voltagex_ 11y ago
      It becomes even more important in an "enterprise" environment. I have machines here which are blocked from executing node.exe (at the time, the binary I had wasn't signed). I have machines here that have to authenticate via SSPI/NTLMv2 to a proxy to get out to the net. And don't even get me started on the SSL MITM we have here. I can't run your startup's app here. I can't run your new build tool here.
      • brazzledazzle 11y ago
        And the endless list of risk reducing stuff like this (and not just in IT either) is exactly why big companies are slow. Big corps need figure out how to create small disconnected divisions instead of consolidating common services for cost savings. If one of your tiny divisions gets hacked it doesn't take down the rest unless your all on the same systems burdened by the same laundry list of security and policies.
  • cyphar 11y ago
    Or have a decent package management setup? Or just use an existing one, it's been working for 20 years. Package management is a solved problem, just use an existing one and move on.
• kofejnik 11y ago
  this is why your dependencies should be checked into git
  • aidos 11y ago
    Then how can you ever install anything in the first place?
    • kasey_junk 11y ago
      Having no understanding of the broader js context I assumed the comment to mean "all library dependencies should be checked in, build tools should be defined & specified & able to fully recreate the build given they are installed". For the record this is a well known & frequently advocated for build pattern.
      • aidos 11y ago
        Fair enough, I guess I was just thinking of the issue I'd run into with trying to actually install anything in the first place. In the case of npm though, installation brings down a lot of files so it's not super efficient. I've installed 15 packages and have over 12,000 files (75MB) to show for it.
        • kofejnik 11y ago
          this is not a serious burden on git, plus they will rarely change
    • profmonocle 11y ago
      You can still do npm install / npm update, just do git add -A node_modules && git commit right after.
  • alexc05 11y ago
    WOW. I've been doing the exact opposite for a long time now. Specifically with Nuget packages, because I could just trust that the package would be there. Considering that node_modules often has something like 4000 files in it, this seems like a huge problem to me. Especially considering the amount of redundancy in node_modules. Uggh... unfortunately if the trust of the package distribution sites is violated then there's no other choice than to check in dependencies. :( I'm not happy about this at all.
• swang 11y ago
  Was that lawyer overreaching? I don't know. But for this guy to expect npm to use their resources to defend him (which they may even possibly lose!) and get mad at them is... a bit presumptuous? Github isn't open source either so is he going to get mad when the lawyers send them an email about kik?
  • stonemetal 11y ago
    If the kik in question is kik.com then >Are you a developer? Kik has open-sourced tools and libraries to help you create great web experiences that can be discovered and instantly shared by Kik's 240 million users. Rather sounds like a valid use of the law, not necessarily nice but valid. They are in the same space, open source web development.
    • jlarocco 11y ago
      Also, they've been around for several years, versus this guy's "kik" project which was created in late October 2015. It seems like a legitimate complaint, IMO.
    • deleted 11y ago
      [deleted]
  • matt4077 11y ago
    It's so easy to avoid name collisions that it doesn't even make much sense to think about it. And trademarks aren't even a feature of the capitalism he so seems to hate: OSS uses names for the same marketing purpose as companies do and larger projects register those trademarks.
  • pluma 11y ago
    NPM Inc like to pretend NPM is infrastructure so they should act like infrastructure. Reinstating the unpublished version of the unpublished module was okay. Taking down a package over an unclear trademark dispute without also informing the author and the public about their reasoning was not. For all we know the claim may have been invalid and npm just doesn't want to risk legal expenses but because they made the decision in private we won't know until they release the prepared statement.
• larkinrichards 11y ago
  I applaud this action and while I'd like to point the finger at NPM, there's no real other method to fix historical package versions that depend on this. It is worth pointing to the silly state of NPM packages: Who decided that an external dependency was necessary for a module that is 17 lines of code? module.exports = leftpad; function leftpad (str, len, ch) { str = String(str); var i = -1; if (!ch && ch !== 0) ch = ' '; len = len - str.length; while (++i < len) { str = ch + str; } return str; } Developers: less dependencies is better, especially when they're so simple! You know what's also awesome? The caret semver specifier[1]. You could install a new, broken version of a dependency doing that-- especially when other packages using peerDependencies rely on specific versions and you've used a caret semver specifier. [1] https://github.com/lydell/line-numbers/pull/3/files https://github.com/lydell/line-numbers/pull/3/files
  • joshmanders 11y ago
    https://en.wikipedia.org/wiki/Unix_philosophy https://en.wikipedia.org/wiki/Unix_philosophy
    • maxaf 11y ago
      Taking an idea to the logical extreme is an effective means of invalidating said idea. How many UNIX utilities are 17 silly lines long? A bit of code duplication would go a long way towards bringing sanity to JS land.
      • joshmanders 11y ago
        Quite a bit are pretty small.
        • cballard 11y ago
          For example: http://www.scs.stanford.edu/histar/src/pkg/echo/echo.c http://www.scs.stanford.edu/histar/src/pkg/echo/echo.c
• galistoca 11y ago
  Reading the article I thought it was some massive popular framework. But when I visited the library's github page, it seems to have only 8 favorites. Am I missing something?
  • hills 11y ago
    left-pad is used in babel. And a lot of ppl use babel
    • galistoca 11y ago
      I guess I need to clarify. If it is indeed the case that he's doing this for a repo with 8 favorites, this guy is essentially using everyone who uses his other libraries as hostage just for vanity. It would be a different story if he had 100+ favorites on that project because then he would be standing up for the entire group who's working hard on it, but I can't think of any reason for doing this other than being selfish
• dc2 11y ago
  > This is not a knee-jerk action. The only thing knee-jerk and honestly irresponsible is not warning anyone first, especially knowing how much his modules were depended upon. Otherwise, there's nothing wrong with this.
  • prodigal_erik 11y ago
    The whole point was demonstrating what npmjs.com has reserved the right to do to any user at any time.
  • pluma 11y ago
    Sounds like npm didn't give him advance warning for kik either, so way to prove a point.
• callmevlad 11y ago
  The fact that this is possible with NPM seems really dangerous. The author unpublished (erm, "liberated") over 250 NPM modules, making those global names (e.g. "map", "alert", "iframe", "subscription", etc) available for anyone to register and replace with any code they wish. Since these libs are now baked into various package.json configuration files (some with 10s of thousands of installs per month, "left-pad" with 2.5M/month), meaning a malicious actor could publish a new patch version bump (for every major and minor version combination) of these libs and ship whatever they want to future npm builds. Because most package.json configs use the "^1.0.1" caret convention (and npm --save defaults to this mode), the vast majority of future installs could grab the malicious version. @seldo Is there a plan to address this? If I'm understanding this right, it seems pretty scary :| [1] https://medium.com/@azerbike/i-ve-just-liberated-my-modules-9045c06be67c#.6je6fouj8 https://medium.com/@azerbike/i-ve-just-liberated-my-modules-...
  • krainboltgreene 11y ago
    That's not how it works. You can't publish left-pad 0.0.3 again.
    • bentlegen 11y ago
      Unless you're npm: https://twitter.com/seldo/status/712414400808755200 https://twitter.com/seldo/status/712414400808755200
      • seanp2k2 11y ago
        ooh gosh, they should really do something like ban new projects from using those names until they figure out a better solution, hopefully with the module author.
        • deleted 11y ago
          [deleted]
        • deleted 11y ago
          [deleted]
• dham 11y ago
  Small modules they say. Small standard lib is ok they say. Just going to point out that in a lot of other languages, string padding is just built into the standard lib.
• mschuster91 11y ago
  brouhaha, this is why you should not put node_modules into .gitignore (same for PHP's composer.lock and vendor/ folder). To be honest, I have waited for something like this to happen so that people finally wake up and realize how deeply and truly compromised the JS ecosystem really is. 11 SLOC not available any more and all over the internet builds are breaking etc.?! And please, why isn't essential stuff like this in the JS standard string library?
  • spriggan3 11y ago
    > brouhaha, this is why you should not put node_modules into .gitignore (same for PHP's composer.lock and vendor/ folder). You should obviously not do that if you are writing a library. You shouldn't publish vendored modules on npm. If everybody did this everybody would end up fetching 100MB packages.
    • badusername 11y ago
      Not adding node_modules to .gitignore would be a very wrong way of solving this issue.
    • mschuster91 11y ago
      For a library yes, but if you're writing software you absolutely must. npm actually deduplicates and flattens your dependencies to reduce clutter.
  • joshuakarjala 11y ago
    some node modules compile platform specific binaries
    • mschuster91 11y ago
      Ew yes, haven't thought of that, but the code that compiles said binaries usually can be re-run to recreate the binary.
  • andrewaylett 11y ago
    Better, you should run your own NPM repository, which transparently caches packages from the main repository. Unfortunately, that's not nearly as easy with NPM as with (say) maven -- the only turn-key solution I'm aware of is Artifactory, and then only in the pro version, and configuring npm to use it is a bit awkward.
• zachrose 11y ago
  So what keeps Kik from going after Github? https://github.com/starters/kik https://github.com/starters/kik
  • hartator 11y ago
    Github has proper lawyers.
  • btown 11y ago
    Well, nothing - in fact, you should remove your comment, because if leadership from Kik sees it, they'd technically be obligated to initiate legal action to defend their trademark. The likelihood that they see it is very low, but...
• overgard 11y ago
  I think it's amusing to see this from the perspective of the company. Some guy uses your trademark without your permission so you tell him to knock it off. He refuses, so you go around him, and so he protests... by fucking over all of his users. In a dispute that doesn't involve them. And people are celebrating this.
  • revelation 11y ago
    Yes if you start from the axiomatic base that the earth is flat, a lot of people around you are starting to sound awfully silly. Then you realize that if your assumptions are wrong, any conclusion from them is valid.
  • wyuenho 11y ago
    I for one wholeheartedly support him. The more collateral damage he causes, the more people are awareness he raises. While the solution to his problem is unclear at this point, it'll at least get us talking, and find out what all of the stakeholders can do better next time, and we as a community to prevent this from ever happening again. I entirely supports his actions.
    • overgard 11y ago
      "awareness". Awareness of what? His trademark infringement? Imagine this from the perspective of a hypothetical user. He's cranky and on a tight deadline, and suddenly his project is broken because some dumb dependency three layers away that he's never even heard of broke because some guy decided to throw a tantrum, and now his software is broken and he has to emergency rewrite part of it. All because this guy didn't bother to check if "kik" was a name he was allowed to use.
      • cyphar 11y ago
        > "awareness". Awareness of what? His trademark infringement? Alleged trademark infringement. Since his project was unrelated to Kik's business, it is questionable whether it was actually trademark infringement or over-zealous lawyers.
• tdicola 11y ago
  I've never felt good any time I have to use node modules and see this gigantic stream of dependencies come flying down. It's even more painful when you need to assemble license information for your software and crawl through _every single dependency and all of their dependencies_ to find their licenses, etc. to check they are OK to use in your software. Just look at the View License info in the Atom text editor some time for a truly insane wall of text (over 12,000 lines!!). IMHO the entire node / NPM system is seriously flawed with so many tiny dependencies for trivial stuff.
  • SlashmanX 11y ago
    Note: There's a cool tool that scans your dependencies and exports all their license info into a csv/json. I've used it before and it's a lifesaver. https://github.com/davglass/license-checker https://github.com/davglass/license-checker
• camwest 11y ago
  FYI I'm the one who republished left-pad after it was unpublished. I think of it similar to letting a domain name expire. The original author removed the code and I forked it and published a new version with the same package name. The main issue was there were so many hard coded dependencies to 0.0.3 so I asked npm support if they could allow me to re-publish that version and they complied since I was now the maintainer of that package.
  • jlg23 11y ago
    Thank you for fixing something that should have never been an issue. You allowed many developers to have a life after work :)
  • kzrdude 11y ago
    Obviously not your choice, but it's a problem of using 0.0.x versions; no flexibility for the crate author to push minor updates.
    • krainboltgreene 11y ago
      That's absolutely not true.
      • kzrdude 11y ago
        The fact that so many depend on exactly the version 0.0.3 indicates it is. What if it were 0.3.0 instead? The common dependency relation would allow 0.3.1 too and allow you to easily deliver a minor update.
    • lmm 11y ago
      If you want the flexibility of pushing minor updates the flipside is you need to provide a definition of what constitutes minor - at which point you should be on 1.x.
  • shruubi 11y ago
    While I can appreciate the predicament this presents, do you not feel like you are going against the wishes of the original author by essentially overtaking him and publishing his code against his will?
• taumeson 11y ago
  Wow, this is an amazing outcome here. Why is "unpublishing" something that can happen in npm? What's the point? I can see the downside, what's the upside?
  • Klathmon 11y ago
    A few reasons off the top of my head: * People sometimes accidentally publish bad info. Passwords, private keys, personal information, etc... being able to remove that is a big plus * if a critical security issue were found in a package, removing that version and adding a new one will practically "force" updates to happen.
    • taumeson 11y ago
      that first bullet point really makes sense to me - feels like there's "no right answer" for that one. i wonder if some kind of time frame would help - one has 72 hours to unpublish, etc. thanks for answering!
      • d0m 11y ago
        Maybe one possible way to fix this problem is to let you unpublish it as long as no one else downloaded it. I.e. once I've got your security, then you're already compromised and you need to change it.
• aioprisan 11y ago
  If NPM wants to stay relevant and a serious contender, they need to have more clear policies in case of IP issues. In this case, the companies weren't even in the same space. Republishing someone's package who has chosen to unpublish and leave your platform is akin to Facebook resurrecting a Facebook profile because they had a lot of friends and the social circle ripple effects would be too high for feed quality for other users, so they chose to reactive the account AGAINST the author's wishes. WHAT?!? We need an open source NPM alternative, yesterday.
  • chc 11y ago
    As best I can tell, before NPM restored it, Azer had transferred ownership to somebody else, who wanted to republish the old version but couldn't. So they do appear to be respecting the maintainer's wishes.
    • aioprisan 11y ago
      That's not how the dependencies in npm work, for most who explicitly replied on owner/project-name notation. Even worse, when unpublished, someone (i.e. malicious actor) could have registered a global name for this or one of many hundreds of packages he wrote, and inject malicious code in all projects from babel to react to my side projects. NPM really got caught with their pants down on this one, and veered into the wrong by opting to unbreak tens of thousands of packages vs. doing the right thing.
  • zanny 11y ago
    > We need an open source NPM alternative, yesterday. NPM is open source.[1] You don't want an open source NPM, you want a distributed consensus NPM where nobody has absolute power to censor or destroy other peoples work. It seems like a prime use case for a DHT, possibly with some blockchain functionality identifying ownership of namespaces that people can reserve, like namecoin. [1]: https://github.com/npm/npm https://github.com/npm/npm
    • aioprisan 11y ago
      I was referring to NPM as in the npmjs.org project, with is a repository, user management platform, etc. Very interesting suggestion in creating a blockchain NPM hosted alternative, with namespace ownerships.
• hartator 11y ago
  Atom.io is not impacted, I think it's a good thing that apm is running on its own network.
  • Dirlewanger 11y ago
    Like trusting Github is much better?
    • hartator 11y ago
      I think it's a bit better, they do have a track record to fight over zealous legal claims - like this one. The Github repository is still untouched.
• vulpes 11y ago
  Here's [1] a list of all modules that were liberated. Some serious land-grab opportunities there [1]: https://gist.github.com/azer/db27417ee84b5f34a6ea https://gist.github.com/azer/db27417ee84b5f34a6ea
  • spriggan3 11y ago
    > Some serious land-grab opportunities there It sums up the biggest issue with npm. Modules shouldn't be a name but a namespace + a name , just like composer. Someone shouldn't be able to have a monopoly on names like "web" or "async". It should be "some-namespace/module-name".
    • STRML 11y ago
      Absolutely. All packages should be namespaced by org or author. This also brings up a very real malware injection possibility: * User removes 'alert' from npm, last version was 1.1.0 * Consumers with "alert": "^1.0.0" now have broken builds * Troll grabs "alert", publishes 1.1.1 with a "postinstall" hook that steals personal data / installs a trojan / deletes data * Major numbers of development machines and some production environments are now compromised Shrinkwraps should also include a package hash to protect users against the repository. I'm starting work on a PR to `ied` that will do this.
• jwiley 11y ago
  I think that unfortunately this was a foregone conclusion. Copyright law, like most other laws in our society, favor corporate interests. I support his stand on principal, however. Azer is a talented developer and has an impressive life story, and has certainly contributed more to society than a social network well know for invading children's privacy. https://medium.com/@azerbike/i-owe-my-career-to-an-iraqi-immigrant-2c075a495b25#.355he9y0b https://medium.com/@azerbike/i-owe-my-career-to-an-iraqi-imm... https://en.wikipedia.org/wiki/Kik_Messenger#Controversies https://en.wikipedia.org/wiki/Kik_Messenger#Controversies
  • jahewson 11y ago
    So, this has nothing to do with copyright law. The word "Kik" is not a creative literary work. It is a registered trademark though: http://tmsearch.uspto.gov/bin/showfield?f=doc&state=4804:liro6q.4.1 http://tmsearch.uspto.gov/bin/showfield?f=doc&state=4804:lir... I don't think there's a problem with trademark law here, I doubt that their claim is legally enforceable against the name of an npm module, as it's pretty obviously outside the goods and services which their mark is registered for. The problem is that npm are capitulating to what I suspect is an invalid request. As is often the case, people are scared of lawyers and forget that they have rights.
  • cyphar 11y ago
    Copyright law is not at all related to this. It was a trademark dispute. You might've fallen into the trap of grouping several unrelated laws into "Intellectual Property", a misnomer which confuses confusion when discussing such laws.
    • jwiley 11y ago
      Good points...I threw out copyright law when trademark is the better terminology
  • gengkev 11y ago
    did you see how he responded to Kik's request? https://medium.com/@mproberts/a-discussion-about-the-breaking-of-the-internet-3d4d2a83aa4d https://medium.com/@mproberts/a-discussion-about-the-breakin...
• yeukhon 11y ago
  If I call my module pizza, are they going to send me an email about naming it pizza? Let's think about that. If a company owns kik as a trademark, I'd offer some money to buy it off before trying to act like a tough guy. At least be soft first if your goal is get rid of kik module out there.
  • PeCaN 11y ago
    I don't believe pizza is trademarked or can be trademarked in any jurisdiction. On the other hand, apparently you can name a package twitter[1] without any problems. 1. https://www.npmjs.com/package/twitter https://www.npmjs.com/package/twitter
    • kennywinker 11y ago
      All of this is dependant on complaints. Certainly Twitter the company could come after and get twitter the module taken down. They have enough twitter related products that overlap conceptually with an NPM module. They've seen no need to up to this point. That doesn't mean they aren't theoretically violating the trademark...
• datashovel 11y ago
  Open source community needs to aggregate a list of lawyers who will consult on these sorts of things (related to the community at large) pro-bono. This way all parties on the open source side can feel a little less pushed around and bullied and a little more protected. The best part would be to learn that the claim was not valid in the first place. At the very least, having representation would provide for some wiggle room where you can have days if not weeks to resolve the issue, instead of feeling you have to take immediate action.
  • wolfgke 11y ago
    And what if in the judicial system of the country that the programmer lives in there is a different legal situation than in the country that the Node.js Foundation (the US)? And what if there are npm mirrors in third countries where the legal situation is different in a third way?
• tobltobs 11y ago
  What would Stallmann say?
  • cyphar 11y ago
    Shoot him an email if you're interested. rms@gnu.org.
• nordsieck 11y ago
  One interesting thing to me, is that it is pretty clear that the kik lawyers pretty dramatically over enforced their trademark. For those who don't know, the purpose of trademarks is to prevent customer confusion; essentially we don't want people to be able to sell cheap knock-offs of someone else's thing without the general public being able to easily distinguish between them. In practical terms, trademarks are "scoped" by their "goods and services" declarations. For example, Apple the device manufacture[1] and Apple the record label[2] could both be trademarked because they had non-overlapping goods and services declarations... until iTunes started selling music[3]. If you look at kik's trademark application[4], you can clearly see that the trademark is limited to chat/media consumer applications, a pretty obvious over enforcement. [1] http://apple.com http://apple.com [2] http://applerecords.com http://applerecords.com [3] https://en.wikipedia.org/wiki/Apple_Corps_v_Apple_Computer https://en.wikipedia.org/wiki/Apple_Corps_v_Apple_Computer [4] https://trademarks.justia.com/858/93/kik-85893307.html https://trademarks.justia.com/858/93/kik-85893307.html
  • smt88 11y ago
    That's not necessarily true if Kik were planning to open up some kind of API. Also, the way the law works in the US encourages corporations to overreach. If you don't try to protect your trademark from every possible angle, it can lead to your loss of it in a court battle. A lot of times, lawyers will send out letters without caring how the recipient responds -- they only need to have sent the letter at all to have covered their bases.
    • gpm 11y ago
      > That's not necessarily true if Kik were planning to open up some kind of API. Surely opening up a new API doesn't give them retroactive rights to the name in that space.
      • smt88 11y ago
        As someone pointed out in another thread, you similarly couldn't name a package something like "facebook" even if Facebook had no API.
• wtbob 11y ago
  The problem here is that there is a single petname space (pet namespace? pet name space?) administered by one organisation but used by everyone. With a different system, the author could have a key $foo, and call his package ($foo kik), and that wouldn't interfere with (us-trademark-office kik).
  • _pmf_ 11y ago
    As done by Maven for a decade. But hey, Java sucks, move fast and break things, right?
• ilaksh 11y ago
  This type of thing is one of the reasons I suggested before that a module registry could and should be a distributed peer-to-peer system.
• jlarocco 11y ago
  Assuming it's kik.com that complained, the complaint to take down the kik NPM module seems legitimate. They've clearly been around a lot longer, are known by more people, and are in an overlapping market. It seems like a lot of people would expect a kik module in NPM to be related to the company in some way, and it wasn't.
  • tapsboy 11y ago
    kik module could have been called kik-messenger Else even http://www.kik.de/ http://www.kik.de/ could claims kik for an API to it's merchandise
• cammsaul 11y ago
  There's a PR open to remove "unpublish" from NPM here: https://github.com/npm/npm/pull/12017 https://github.com/npm/npm/pull/12017
  • cyphar 11y ago
    I love how it was said that something like this has "only happened 3 times in the last 2 years". The fact that it's so easy to break npm is hilarious, and of course the maintainers don't care.
• repn001 11y ago
  Not a Package Manager (NPM)
• hellbanner 11y ago
  Can we talk about how patents own namespaces? If I have a little "kik" soccer tournament that no one knows about, then it's fine. As soon as the namespace collides with the HUGE, vastly connected internet, it's a "problem". We're going to run out of proper nouns, folks.
  • cyphar 11y ago
    > Can we talk about how patents own namespaces? This has nothing to do with patent law. It's a trademark dispute. The two types of laws are as unrelated as property law and contract law.
• tobltobs 11y ago
  My congrats and respect for his decision. Through actions like this companies might understand that the current trademark (and patent) law is only benefiting lawyers. And wouldn't it be wonderful if as a result of this the build for KIKs Pedo API are broken?
• chvid 11y ago
  I really just hope that this guy just didn't know what he was doing and what effect it would have. Otherwise it is totally irresponsible to mess up a big project like babel just because you control a few lines of trivial code.
  • tobltobs 11y ago
    Or is it irresponsible from the company to let loose your lawyers on a FOSS project because it uses a three letter word as a package name?
  • lovelearning 11y ago
    Can't believe the dev is made out to be the bad guy here. It may be a "few lines of trivial code" but it is still his code and he has the right to do whatever he wants with it. He tried the reasonable thing, NPM didn't oblige, he pulled the rug. Serves them right. If it's a few lines of "trivial code", then maybe big project Babel should stop using that "trivial code"? And why does this yet-another-messenger-flash-in-the-pan app "Kik" get the right to mess up big projects just because they control 1 permutation of 2 letters of the English alphabet?
    • bryanrasmussen 11y ago
      responsible behavior is on a sliding scale, he had the rights to do this, but he could have been more responsible by first publishing a notice he was going to do it in a week, and even more responsible if he figured out the big projects using his code and sent them all an email ( but that would be a lot of work, hence the greater responsibility undertaken - I mean I sure wouldn't go through that trouble) Was he irresponsible? That seems a bit much, I think he was at responsibility level average - he did what he had the right to do and with good reason after NPM treated him badly and published a good document outlining the reasons, which I guess was helpful for people seeing why using NPM at all might actually be irresponsible. But he could have been more than responsibility level average.
• grapehut 11y ago
  My biggest issue with npm is the lack of verifiable build. Even if I read it on github, I have absolutely no idea if that's exactly what the person uploaded to npm. I very well could have malicious code and not know it.
• howareroark 11y ago
  If I can buy a domain from ICANN for 10 bucks and then sell it to a company for a million... Why can't this guy reserve the right to sell this to that company for a million?
  • ricardobeat 11y ago
    Nobody is going to pay anything for a package name when NPM Inc. can just yank it out of your hands at their discretion.
• EGreg 11y ago
  I'd like to liberate your modules The new pickup line
• sbuttgereit 11y ago
  I've been reading in the comments regarding 1) the practical effect of breaking builds and 2) the security issues of how package names can be reused on npm once they are unpublished (versioning aside for a moment). I wonder what other, similar, packaging distribution platforms are vulnerable to this sort of thing? I am not speaking from knowledge of any of the procedures of any of those I'm about to mention, but I have and do depend on some them. Thinking about this issue and some of those other tools that pull long strings of dependent packages does give me pause. Especially the replacement of some dependency with less than friendly code... breakage can be managed, but silent invaders... Does Perl & CPAN, Rust & crates.io, or Ruby & RubyGems.org suffer these same issues and it just just hasn't been a problem yet? Do they have means of avoiding this? Again, I haven't studied the question... but I think I may :-)
  • steveklabnik 11y ago
    With crates.io, users cannot delete their packages. They can 'yank' a version, which means that no new packages can depend on it, but existing packages can. So in this specific case, there are two packages: kik, the subject of the legal threat, and left-pad, another module by the same author. If we were compelled through legal means to remove a package, as administorators, we could, which is what happened with kik. However, if said author got mad at us, they couldn't _delete_ their other packages, only yank them, and so people's builds would not break, like they did here. Does that make sense? (IIRC Rubygems acts in the same way)
    • sbuttgereit 11y ago
      It does. Given that I've started a project in Rust which will have such dependencies, I feel even better that clearly there has been some good thinking put into this.
  • nirvdrum 11y ago
    I've had deploys break because gems were removed from RubyGems.org. Using CI as a gate isn't sufficient because a gem can be removed in the window between a completed CI run and the deploy. Making it harder, generally if you have a gem installed locally you won't notice the problem until you need to install it on a fresh system. It used to be the case that a yanked gem was simply removed from the gem index, but the file was still published, so you'd still be able to install it. Now the gems are deleted, eliminating that option. So, other systems are definitely susceptible and it does burn people. I just don't think we've seen an issue on this scale yet. The largest I've hit have been when the twitter gem was yanked in advance of Twitter's shutdown, a fog-XYZ gem being yanked as new versions were released, and at least one yanked version of net-ssh. The only really effective way to avoid this is to mirror all your dependencies yourself (and not honor upstream yanks) or vendor all your gems. I know of exceedingly few people doing this. I've yet to encounter a legitimate cause for a yanked gem. But I worry more that a bad actor gains credentials to a high profile account and just wreaks havoc on the ecosystem. On that note, I have found and reported users that've committed their RubyGems.org credentials to GitHub in a "dotfiles" repository.
• jahewson 11y ago
  This is a really bad decision on npm's part. Kik's laywer has pulled a fast one on them. Kik has no right to enforce the Kik trademark beyond the limited set of goods and services listed in the trademark application [1]. Kik is a registered word mark for mobile messaging software only. That's why the trademark database contains many entries for just the word Kik, other companies own the use of that word for other goods and services. I'm really surprised that npm didn't push back against this. It's not like npm isn't full of trademarks: https://www.npmjs.com/package/pepsi https://www.npmjs.com/package/pepsi https://www.npmjs.com/package/coke https://www.npmjs.com/package/coke https://www.npmjs.com/package/kfc https://www.npmjs.com/package/kfc https://www.npmjs.com/package/virgin https://www.npmjs.com/package/virgin https://www.npmjs.com/package/sprint https://www.npmjs.com/package/sprint https://www.npmjs.com/package/nba https://www.npmjs.com/package/nba https://www.npmjs.com/package/nfl https://www.npmjs.com/package/nfl https://www.npmjs.com/package/google https://www.npmjs.com/package/google https://www.npmjs.com/package/yahoo https://www.npmjs.com/package/yahoo https://www.npmjs.com/package/skype https://www.npmjs.com/package/skype https://www.npmjs.com/package/word https://www.npmjs.com/package/word https://www.npmjs.com/package/excel https://www.npmjs.com/package/excel https://www.npmjs.com/package/unix https://www.npmjs.com/package/unix https://www.npmjs.com/package/windows https://www.npmjs.com/package/windows https://www.npmjs.com/package/osx https://www.npmjs.com/package/osx [1] http://tmsearch.uspto.gov/bin/showfield?f=doc&state=4804:liro6q.4.1 http://tmsearch.uspto.gov/bin/showfield?f=doc&state=4804:lir...
  • ShaneCurcuru 11y ago
    Trademarks: even more understood to modern programmers than C++ multiple inheritance. Trademark owners - especially registered ones - can ask you to treat their mark any way they like. Legally, they can only try to enforce the basics of trademark law, but trademark litigation is typically expensive and risky. USPTO Pro Tip: links to their search are session-specific. You have to use the blue TSDR link to share: https://tsdr.uspto.gov/#caseNumber=86930821&caseType=SERIAL_NO&searchType=statusSearch https://tsdr.uspto.gov/#caseNumber=86930821&caseType=SERIAL_...
• adamkittelson 11y ago
  About a year ago I tried to unpublish a version of a library I'd pushed to Elixir's hex.pm package manager but the API rejected it. Turns out they only allow you to revert publishing for an hour after you push. It was a little inconvenient at the time but in light of this I can very clearly see the wisdom of that decision.
• dham 11y ago
  What if Kik uses Node and they broke their own builds inadvertently by enforcing their trademark. 0_0
• forrestthewoods 11y ago
  Why yes, depending on a third-party, external package manager is a huge risk. I have always believed that open source projects should be fully inclusive of any and all dependencies. This event has not changed that opinion.
• sklivvz1971 11y ago
  The problem here is that NPM is a private company in an institutional role. You will always have some very common dependencies which, if brought down or altered, could compromise a lot of projects. The problem is that npm has to act like an institution, not like a private company.
• spriggan3 11y ago
  It's high time people publishing packages on NPM audit their dependencies. I bet 80% of them are unnecessary.
• guhcampos 11y ago
  "This is not a knee-jerk action" Yes, it is. The fact you did not know about a company branded "Kik" does not make you excempt from the law. A law which, surprisingly enough, is being used in a reasonable situation here. Your package and their segment are closely enough related in context that people could assume they are actually related, giving you the power to essentially break their business if you do bad stuff. In this case it's not really a trolling coming from them. You don't just brand your new beer brew "Coca-Cola" - there's no reasonable argument to do that besides being a troll. P.S.: holy crap npm is so broken I'm glad I'm on the backend side of life.
  • BHSPitMonkey 11y ago
    They are not exempt from the law, but in this case the law does not actually support Kik's exercise of trademark. NPM's staff buckled under the lawyers' threats, but had it gone to court the case would get thrown out. Kik's trademark does not cover the functionality of this project.
• fiatjaf 11y ago
  Why isn't GitHub the source of all node packages? npm supports it very nicely. I mean: why don't people write `npm install user/repo --save` instead of `npm install package --save` every time already?
  • _ZeD_ 11y ago
    because it does not make sense: I don't want the sources, I want a usable package...
  • Havvy 11y ago
    Because there's no version control that way. If I depended upon babel/babel (or whatever it's called on Github), when it changed from v5.x to v6.x, it would have broken my build.
    • SlashmanX 11y ago
      You can ask for a specific tag/branch using Github dependencies using babel/babel#v5.x
  • alessioalex 11y ago
    In addition to what other people have said, the exact same thing could have happened even if the project was only hosted on Github. Github could receive a DMCA notice, take down the repo and buf.. gone.
• bbcbasic 11y ago
  > This is not a knee-jerk action Seems like it. Why break everyone's builds? You could just keep the modules there and then declare you will only keep them updated elsewhere?
  • hellbanner 11y ago
    Maybe he wants the developer community to class action kik.
  • lerpa 11y ago
    I think what actually is a knee jerk reaction being irresponsible with your dependencies and blame others for your lack of foresight. He doesn't owe you anything. You and other should be thankful for him to have allowed you to use his code. Fuck that entitlement bs.
    • cyphar 11y ago
      Except of course that the library in question is 12 lines of code. And that you might not even know that three levels down your dependency tree someone used that module.
    • bbcbasic 11y ago
      > I think what actually is a knee jerk reaction being irresponsible with your dependencies and blame others for your lack of foresight. Er.. actually I don't use NPM. > He doesn't owe you anything. You and other should be thankful for him to have allowed you to use his code. Fuck that entitlement bs. Yes but I belong to the adult world, so if I had a package that load of people relied on, wrongly or rightly, I wouldn't just drop it knowing it would be harmful to other projects, just for the sake of causing chaos. It's all about the mens rea.
• alongtheflow 11y ago
  Aftermath of situation from left-pad. Some says that it started to break major projects like react-native. https://github.com/azer/left-pad/issues/4#issuecomment-200062925 https://github.com/azer/left-pad/issues/4#issuecomment-20006...
• dclowd9901 11y ago
  While I don't disagree with OP's angst, fuck them for choosing pride over working products. It's irresponsible and shows a complete lack of maturity. I'll make sure never to consume their modules in the future. God forbid they have a bad day and decides to insert malicious code into their modules.
  • JeremyBanks 11y ago
    You should greatly thank him for highlighting the flaws in your system if this caused significant issues.
    • dclowd9901 11y ago
      What he did is analogous to someone breaching a trust system by doing something untrustworthy. If the argument is we shouldn't have trust systems, fucking bravo. Isn't the world a great place?
• octref 11y ago
  Why don't people just use lodash? https://lodash.com/docs#padStart https://lodash.com/docs#padStart It's well-tested, well-maintained, performant, with good documentation and has custom-build to leave out functions you don't need.
  • mjrbrennan 11y ago
    I had that same thought the other day. We are ending up with thousands of 11-line "micro-libraries" that just cause huge dependency issues and have limited usefulness. Like you said, lodash is well-tested, well-maintained and performant with good docs. So why isn't it just used more by these libraries? It shouldn't be a size problem either, if you really want to you can require individual lodash functions in node.
  • skeoh 11y ago
    My project didn't 'use' left-pad -- yet it was affected by its removal. The story here is not about the specific project that was removed but that in the npm architecture it is possible for a single maintainer to negatively affect hundreds of people and projects with ease.
  • progx 11y ago
    And when a lodash (trademark holding) company knock the door and sey "hey, you cant use lodash anymore", what happen then? Will npm remove it or replace it?
    • jdd 11y ago
      If there was ever an issue I'd work with npm to come to a resolution that didn't break 25% of npm.
• joeandaverde 11y ago
  Here's a highly downloaded 11 line module with lots of dependents. https://www.npmjs.com/package/escape-string-regexp https://www.npmjs.com/package/escape-string-regexp I stopped searching at 1. I've certainly benefitted from the vast ecosystem of npm. I greatly appreciate the work that goes into making this ecosystem what it is. However, I think we need to be a bit more critical when it comes to acquiring dependencies. Especially authors of very prominent packages. Fun fact: one of my projects (a web api) depends on over 700 unique name/version modules. Fellow programmers. This is embarrassing.
  • sotojuan 11y ago
    Sindre basically treats npm as his snippet database. I don't see anything wrong with it. See: https://github.com/sindresorhus/ama/issues/10#issuecomment-117766328 https://github.com/sindresorhus/ama/issues/10#issuecomment-1...
• diffraction 11y ago
  kik has lawyers all over the world... because it is the platform of choice for pedophiles and sexual predators. there are many billable hours spent responding to doj/states attorney subpoenas. (http://www.trentonian.com/general-news/20140728/pedophile-on-kik-app-its-well-known-in-our-industry http://www.trentonian.com/general-news/20140728/pedophile-on...) (http://woodtv.com/2015/02/02/sexual-predator-warns-parents-about-kik-app/ http://woodtv.com/2015/02/02/sexual-predator-warns-parents-a...)
• smsm42 11y ago
  Reading some of the comments reminds me old tale about a young man, that every morning on his way to work passed by a beggar and gave him a coin (that was back when coins actually had some value). One morning though the beggar notices the coin is smaller than usual, and he asks: - Why you gave me a different coin today? and the young man says: - I got married and now I'm starting a family, I need more money so I can not give you as much anymore. And the beggar cries out: - People, look at this putz, he got married, and now I have to feed his family?! I think the fact that we get so many awesome things for free is unbelievably lucky. I mean, not only we work in the one of the more generously paid jobs, we also get a lot of the tools we need for free! How cool is that? But some people think that if they are given those awesome things for free, they must deserve it and whoever gives them owes them forever. That's not the case. Yes, it is annoying to find somebody who contributed before does not want to do it anymore. It is mildly inconvenient and it can be improved. But let's not lose the perspective - the author does not owe us or npm continued support. It is sad he does not want to do it anymore, but that's what open source is about - people can take it over, and it happened within a single day. Such resilience is something to be proud of, not something to complain about.
  • gosukiwi 11y ago
    Reminds me of this: https://www.youtube.com/watch?v=7rMpCud1IwQ https://www.youtube.com/watch?v=7rMpCud1IwQ
  • visarga 11y ago
    > But let's not lose the perspective - the author does not owe us or npm continued support On the other hand, he wanted his work published in the community registry where they got exposure and were made into dependencies in lots of projects. When the author offered their modules and then suddenly walked away with them, lots of innocent devs who built their projects with his modules got hurt. He did more bad than good overall, especially that he unpublished hundreds of modules at once without warning, not just one. He should carry some responsibility for that. The author can publish and unpublish all he wants from his personal site where there are zero expectations that it will continue to exist, but when he's doing it from a public repository where he received a lot of confidence from the community, he should at least make sure his users don't suddenly fall flat. Now people will start wondering if a module with millions of installs in the last month is still going to exist tomorrow.
• nikolay 11y ago
  IED [0] + IPFS [1] + GPG looks like a dream come true. Note: IED could be much faster than NPM installer due to parallel downloads, which would work great with the slower IPFS. [0]: http://gugel.io/ied/ http://gugel.io/ied/ [1]: https://ipfs.io/ https://ipfs.io/
  • tlrobinson 11y ago
    That sounds super neat. I wonder how you could bootstrap a IPFS package repo from an existing one like npm's. EDIT: just came across an IPFS backed npm registry mirror project: https://github.com/diasdavid/registry-mirror https://github.com/diasdavid/registry-mirror
    • nikolay 11y ago
      The good outcome of this nasty incident (especially with the followed hijacking) is that it was a wake-up and (hopefully!) package managers will take notice!
• lerpa 11y ago
  Good for him, if that platform isn't working go somewhere else. The major problem here is relying on a central authority like NPM in the first place.
• lukegt 11y ago
  I like how npm even encourages you to create packages in place of the "liberated" ones when you try to visit their now missing pages: https://www.npmjs.com/package/abril-fatface https://www.npmjs.com/package/abril-fatface abril-fatface will be yours. Oh yes, abril-fatface will be yours. mkdir abril-fatface cd abril-fatface npm init # work your magic… npm publish
  • cooper12 11y ago
    That's actually their standard 404 message: https://www.npmjs.com/package/lukegt-test https://www.npmjs.com/package/lukegt-test.
• nchelluri 11y ago
  Wow, very interesting post for me. Earlier today, at work, we ran into an issue where `npm install` was failing because the `shuffle-array` module wasn’t found. Investigation showed that the cause was that it was unpublished today. We found that this was a required dependency of the `match` module and this was in our dependency list in`package.json`. We investigated and found out that it had been erroneously committed — it’s actually a memory game and has absolutely no place in our webservice project. :) (Mistakes happen… dependency audits can be worthwhile!) Now, some hours later, I found your post on HackerNews and was really shocked to see, hey, this is exactly why it was unpublished. Quite a chain of events. Never thought I’d figure out why the modules were unpublished, but now I get it! Thanks for the explanation. [crossposted from the medium article]
• stblack 11y ago
  I read the whole damn thread and nobody, nobody links to the assholes that deserve to be kik-ed.
• deleted 11y ago
  [deleted]
• rzimmerman 11y ago
  npm really shouldn't let authors unpublish. It should definitely be impossible to overwrite a published package version (it is, but only for the past year or so). When you install express, you install 40 dependencies. Each of these has separate maintainer(s) and coordination is optional. If we're going to allow this dependency mess to grow organically, npm needs to be strict about what gets published and we need to be really careful about depending on anything but a strongly pinned version.
• zakame 11y ago
  Sounds like something that would not likely happen on other repos like the CPAN/CRAN/CTAN. Perhaps the JS community at large would be better off with a similar system? I remember sometime long ago that there was a JSAN effort: http://www.openjsan.org/ http://www.openjsan.org/
• erikb 11y ago
  I don't see the issue here. If the name is taken the lawful way (and Kik is a clothes store chain as well as a chat app, so it's even taken twice) why fight it or be angry about it? Just take another name. That said the decisions by NPM are also hard to follow. Why allow someone else to take over ownership of a package? Why allow anyone to take down published versions of an open source package? If you publish open source stuff on my site I have all the right to keep that stuff in that version and share it with others. That's pretty much what FOSS is about, right?
• jimjimjim 11y ago
  I am obviously a old fossilized ancient developer. This situation seems like insanity. not the unpublishing part. the part where the thing that you require to sell/publish/do your job isn't under control or isn't stored within your organization. Am i wrong in thinking that you should just have a local copy of all of your source code dependencies. would it really take that much longer?
  • pmontra 11y ago
    It's pretty common, to name only the ones I'm more used to Ruby has gems, Java maven, Perl CPAN, Node NPM, Python pip. All languages have package managers nowadays and has been like that for a long time. They give you the way to make local repositories but I don't know anybody doing it. Maybe developers working inside some companies have some process to go through the company repo. Setting up the repo and maintaining it is quite an overhead and somebody has to pay for it. But I agree that it's the sane way to work, maybe not the most profitable. Edit: typos
    • jimjimjim 11y ago
      fair enough, but i'm still shaking my head. these places can't have QA departments.
      • mattmanser 11y ago
        When are you from, 2005? It's been like this so long now even MS use this model with nuget. You sound seriously out of touch.
        • gedrap 11y ago
          No, he's just careful and professional. Pulling packages from npm on every build in relying on it seems like fine for a little startup that no one would actually care if it went down for a day or two. That's fine. But there are plenty of applications where it would be a catastrophic fuck up to break things because someone somewhere decided to delete something.
• stevebmark 11y ago
  This seems like a fairly childish response. I'm not pro-copyright, especially in software, but "someone took my made up name" seems like a dumb reason to unpublish the rest of your work. > "NPM is someone’s private land" No shit npm is a privately owned company? That hasn't changed before nor after you took these actions. > "Power To The People" This is what I don't get. All of the modules that were unpublished seem unpopular / not used so I don't know what impact this will have, but how does screwing over users of open source software equate to power to the people?
• julie1 11y ago
  The number of coders complaining about an author exercising the basic of intellectual property rights is too high. 1) all coders should understand authors right be the code free or closed; 2) there is no excuse for someone whose value is based on creativity to ignore how IP works (the good and the bad part) because our comfortable incomes come from the protection these rights gives to our work 3) if your code is broken for 11 sloc, maybe you depend too much on others work and you have no value yourselves. Benevolent persons sharing their code on their free time owes you nothing. Repay authors whose code you use. Buy closed source software, and at least respect the free software authors. It costs you nothing already.
  • awolden 11y ago
    > 3) if your code is broken for 11 sloc, maybe you depend too much on others work and you have no value yourselves. That is very out of touch with the reality of development on the modern JS stack. Babel is a key transpiler that allows people to target multiple browsers with consistent JS, and it was completely broken by this move. Are you suggesting that everyone rewrite their own babel? I guess if they don't they have no real `value`.
    • julie1 11y ago
      I worked in ad industry. We had are own 3k lib with code inspired by jquery to deal with that problem of "fixing the browsers incompatibility", because vanilla JS does ,not exists when DOM/browser functionalities are added to the equation. I learned to use CSS without framework, and it helps a lot both writing efficient CSS selector and fast loading HTML that is reactive ... and maintainable easy to fix/deploy CSS. Once you learned it. Yes I suggest that it can be done. But I cannot do it anymore because no modern coders want to learn all that. Thus my CTO, and colleagues always complained that it should not be done this way. Well ... I used to complain to much dependency is fragile, vulnerable and they say, let us follow the hurd. I say, your code is expensive to write, maintain, support. They said no. Else we find no one, and no one wants to learn this ol' shit. Look where we are today? The mass can be wrong I guess. Being right makes you jobless but at least when the bubble will explode I will be valuable again. And I will make people pay a lot for my skills of having no skills in babel, angular 2, react ... Less is more. Especially for a backend coder.
• ecthiender 11y ago
  Well done OP! I stand in solidarity with OP. I think this is a good way of showing our resistance to corporate power - by boycotting them.
• zongitsrinzler 11y ago
  Extremely dick move on behalf of the developer. Why would you remove modules that other people are using in production? Did you think a small team like NPM would go head to head with a company having full time lawyers? And for what?
  • stbtrax 11y ago
    you should ask for your money back
  • jzs 11y ago
    Why is that a dick move? What would you do if npm or github goes down tomorrow? Vendor your dependencies if you want to make sure your own project doesn't break.
    • zongitsrinzler 11y ago
      I am not affected by this. It just seems like a childish move that only hurts the users. NPM did not go against its ToS.
      • archgoon 11y ago
        Neither did he.
  • spitcode 11y ago
    He was threatened by lawyers the real assholes are Kik for taking hiring lawyers to ask him to rename his module
• jonathankoren 11y ago
  My god! It's full of attack vectors! https://github.com/substack/provinces/issues/20 https://github.com/substack/provinces/issues/20
  • swang 11y ago
    kinda a dick move to unpublish a module not created by you. but hey NO TIME FOR THAT when your HONOR of naming something kik is in jeopardy from npm. Definitely, definitely, not a knee-jerk reaction.
• deleted 11y ago
  [deleted]
• zwetan 11y ago
  funny thing, but assuming that kik is related to kik.com if you look here http://dev.kik.com/build/ http://dev.kik.com/build/, they promote their own server eg. "Our open source web server Zerver can help serve your cache manifest properly, as well as doing other speed boosting stuff like automatic style inlining." this Zerver is on github and build with npm https://github.com/jairajs89/zerver/blob/master/package.json https://github.com/jairajs89/zerver/blob/master/package.json I did not run the build but I'm pretty sure that now their server is not building anymore as it depends on babel call that irony ;) ?
  • brazzledazzle 11y ago
    I had my suspicions that this was all motivated by wanting to grab the npm package name "kik" and the fact that they use node and npm almost cements that for me. I have a feeling this was never about protecting trademarks at all.
• fold_left 11y ago
  I've been warning of the potential for issues like this for quite a while and would be really grateful for people's feedback on this approach to try and insulate your projects from them https://github.com/JamieMason/shrinkpack https://github.com/JamieMason/shrinkpack. Its not completely there yet, but I think there's something worth exploring further in this idea.
• fold_left 11y ago
  I've been warning of the potential for issues like this for quite a while and would be really grateful for people's feedback on this approach to try and insulate your projects from them https://github.com/JamieMason/shrinkpack https://github.com/JamieMason/shrinkpack. Its not completely there yet, but I think there's something worth exploring further in this idea.
• gambiting 11y ago
  I have read the post and I still have no idea what NPM is.
  • GFK_of_xmaspast 11y ago
    A miserable pile of micro-dependencies, apparently.
• sjclemmy 11y ago
  I am a heavily invested user of JavaScript and the surrounding ecosystem and the security aspects of the npm package system has been in the back of my mind for a while. As I don't consider myself an 'expert' in all things npm and package management I've deferred to the general consensus, which didn't seem to mind too much about the security problems npm exhibits (This reminds me of the sub-prime crisis). I think an event like this is a really positive thing, as it promotes discussion about something that is exceedingly important. All it takes to exploit this vulnerability is a bit of time and effort, it looks really easy to inject malicious code into any number of 'de-published' packages. I hope that some kind of name spacing and / or locking of npm packages results from this and that the javascript ecosystem continues to mature and develop in the right direction. Npm inc have an opportunity here to do the right thing. If they don't then there's going to be a mutiny and a 'better' alternative will supersede npm. Bower anyone? ;)
• _it_me 11y ago
  Lol that satire flipped bit site even caught it http://www.theflippedbit.io/2016/03/23/developer-outraged-asked-remove-whatsapp-package-npm/ http://www.theflippedbit.io/2016/03/23/developer-outraged-as...
• staticelf 11y ago
  We gotta support: http://puu.sh/nQOLH/d225ff95d3.png http://puu.sh/nQOLH/d225ff95d3.png :D
• drinchev 11y ago
  Sadly there is a user @nj48, who already published empty modules and took the names [1]. Is this a joke or something coordinated with the community? [1] https://www.npmjs.com/~nj48 https://www.npmjs.com/~nj48 EDIT : The hijacked modules look suspicious. http://www.drinchev.com/blog/alert-npm-modules-hijacked/ http://www.drinchev.com/blog/alert-npm-modules-hijacked/
  • lasdfas 11y ago
    @nj48 is just some troll who took all the names. Not sure the intention of @nj48. The hijacked modules are not dangerous at this point, but that could easily change and cause serious issues.
• tehwalrus 11y ago
  Sounds like NPM should move to pulling in the code from specific github tags or something? although I suppose, github is also "private land"...
• gedrap 11y ago
  Thanks to this, I hope people will consider the way too common deployment approach when during the build time you pull stuff from npm (or whatever external package manager/repository), and if it fails, the build fails. This is fine for small projects. There are tons of applications where availability is less important then development speed. However, not being aware of the risks and tradeoffs you're making is just plain simple insanity.
• albertfdp 11y ago
  In order to check if I was affected by any potentially malicious hacker that gets ownership of one of the existing liberated modules and adds malicious code on them, I have created a small script to check that: https://github.com/albertfdp/did-azer-break-my-stuff https://github.com/albertfdp/did-azer-break-my-stuff
• jordanlev 11y ago
  How does serving his modules from a different corporate-controlled repository (github now instead of npm) serve his purpose of "liberating" the code from potential corporate meddling?
• cat-dev-null 11y ago
  NPM is a for profit, so they're a SPoF from lawyers and governments seeking to control others. The other issues is a lack of distributed package/artifact replication which makes it possible to take down an entire ecosystem by unplugging a few servers.
• justaaron 11y ago
  oh geez.... welcome to trademark law Google. (why is this getting frontpage HN coverage?) a trademark is a globally enforceable right (madrid agreement) and one has an obligation to protect ones mark from "dilution" from others in the same category: i.e. if you are selling "apple" garden shovels, you needn't worry about crossing into "apple" computer land, but I guarantee you that they already registered that mark for "home electronics" etc. Most countries require formal registration of the trademark (they are searchable in online databases) and most will go on a "first filing" basis. but several, including the USA, go by a "first usage" basis and require you to prove your use of the mark in public... it's a long shot, but you can always look of that company has, in fact, registered that mark, and in which country/territory are they claiming usage rights. (for example, they can't be a local computer shop named "apple computers" that only sold to locals since 1854, that suddenly sells computers on the global market, as there is already a global entity with that name registered)
  • coreyp_1 11y ago
    The trademark issue is actually of minor importance here. What is being highlighted is that a publisher of a large number of npm modules removed all of his modules. This broke some people's builds, but, more importantly, drew attention to 2 HUGE security issues: 1.) NPM arbitrarily gave control of a package to a 3rd party, who can then do all manner of evil with it, if they so prefer. 2.) The namespaces of all of these somewhat widely-used packages are now up for grabs. That is, you could make your own malicious version, upload it to NPM, and now all of those builds in all of those different projects will now use your malicious code. The issue isn't trademark, it's security. That's why it's on the front page of HN.
• Confusion 11y ago
  Meta: please don't upvote for agreement if facts are asserted that you cannot corroborate. And please carefully consider whether you only believe or actually know something is true. A lot of patent falsehoods are being asserted and upvoted in this thread.
• Wintamute 11y ago
  I'm confused weren't scoped packages added to avoid all of this sort of thing? Kik should just have used "@kik/kik", and the original package author should have been left alone.
• cdubzzz 11y ago
  Does this series of tweets [0] seem rather odd to anyone? He seems to be calling people soulless and pondering his own "Power and Responsibility". [0] https://twitter.com/izs/status/712510512974716931 https://twitter.com/izs/status/712510512974716931
  • mstade 11y ago
    That is some serious highfaluting language going on in those tweets. Something something if you play the game something something...
    • cdubzzz 11y ago
      The whole thread is just really astounding. I am rather neutral on the drama here, but I am certainly coming away with a real distaste for npmjs just from reading that.
      • mstade 11y ago
        You and me both. I wish I could up-vote your comment twice!
• sirmiller 11y ago
  About time somebody has the balls to stand up and do the right thing!
• mstade 11y ago
  The ability to "unpublish" a package is fundamentally strange, because it enables situations like this. It's also strange that people put so much trust and faith into a private company to host and distribute packages – largely for free – and then rile against them when they do stuff like this with infrastructure they own. NPM is not some free and open space, it's a private company with private interests. You should expect them to do whatever they need to protect those interests – which may or may not coincide with public interest. I hope this resolves in more people getting involved with projects like IPFS and Nix, that may ultimately provide some recourse to the issues of centralized package management.
• pluma 11y ago
  By complying with kik's request, npm has set a precedent for library authors that basically means: in doubt, you will lose your package name, even if you dispute the trademark. This means npm apparently wants everyone to handle trademark disputes like Jade did: https://github.com/pugjs/pug/issues/2184 https://github.com/pugjs/pug/issues/2184
• joepie91_ 11y ago
  For everybody discussing decentralization of NPM in the comment threads down below, please read the following thread: https://github.com/nodejs/NG/issues/29 https://github.com/nodejs/NG/issues/29 Much of the thinking work has already been done.
• cdnsteve 11y ago
  More details of the story: http://www.theregister.co.uk/2016/03/23/npm_left_pad_chaos/ http://www.theregister.co.uk/2016/03/23/npm_left_pad_chaos/
• Chyzwar 11y ago
  We should just troll them and created packages with kik in name like: kik-looser iKik only-kik true-kik true-kik2 real-kik
• TimJRobinson 11y ago
  Quick script to test if your project is using any of the modules he unpublished: for module in $(curl -s https://gist.githubusercontent.com/azer/db27417ee84b5f34a6ea/raw/50ab7ef26dbde2d4ea52318a3590af78b2a21162/gistfile1.txt); do grep "\"$module\"" package.json; done If any names appear you should replace them or force that specific version always (remove ~ or ^ before it). If nothing appears you're probably good.
  • zackboe 11y ago
    Snyk added a 'test-unpublished' command to check all dependencies, but "is currently limited only to the packages Azer just unpublished, as opposed to all unpublished packages." https://snyk.io/blog/testing-for-unpublished-packages/ https://snyk.io/blog/testing-for-unpublished-packages/
    • trumbitta2 11y ago
      I'm not sure node is a safe choice for such a script, given one of the dependencies (or one of the dependencies' dependencies and so on) could use one unpublished module now or at some point in the future. That's why I chose bash for mine: https://github.com/trumbitta/kik-check https://github.com/trumbitta/kik-check
• larrik 11y ago
  I don't think Kik is the bad guy here. This npm module was rather new (<6 months?), while Kik Messenger has been around for years, and is VERY popular with the young crowd. They are both software. It would be like the author naming his module 'imessage' or 'spotify', except this is with a company that isn't as visible to the HN crowd. I personally think him not knowing Kik existed was odd, and not googling the name at all even odder. Even still, I think Kik's response and npm's response were perfectly valid. Looking at the voting of the comments here makes me sad for what has become of the HN community.
• Trisell 11y ago
  I think this blossoming episode leads me to believe that if you are running a production app, then you need to be hosting your own internal npm, and updating that from the global npm. That way when something like this happens you are able to continue on, and not have many issues, like the builds braking that are being reported on github.
• studentrunnr 11y ago
  npm will improve after this and that is a net good thing which comes from this.
• miiiichael 11y ago
  I'm adding this bash script to the conversation. https://gist.github.com/mbranch/f77e62d91f46972dcc32 https://gist.github.com/mbranch/f77e62d91f46972dcc32 It reports on the inclusion of unpublished modules in all package.json files found in deeper directories.
• flurdy 11y ago
  Can NPM not add to their TOS and features a "notice period"? With a grace period for errors e.g. if published and older than one week to remove a package you have to give notice first, e.g. 2 months. With a suspension before actual removal? With some avenues for expedite removal/suspension ie security and legal, which would have removed kik quicker but not leftpad. Whether people would be aware of the notices or ignore them is another issue.
• antouank 11y ago
  > npm took the name away because they reasoned that more people would think that `kik` the pkg would refer to kik the app. full stop. https://twitter.com/ag_dubs/status/712669386511949824 https://twitter.com/ag_dubs/status/712669386511949824
• kelvin0 11y ago
  The only Kik I knew was the Cola: https://p2.liveauctioneers.com/1164/26545/9944497_1_l.jpg https://p2.liveauctioneers.com/1164/26545/9944497_1_l.jpg So this lawyer he's from what company? Cause there seems to be quite a lot a Kiks around these days (Kik Messenger?)
• trumbitta2 11y ago
  Trying to help with damage control: https://news.ycombinator.com/item?id=11346633 https://news.ycombinator.com/item?id=11346633
• kikcomms 11y ago
  Hi everyone, please read this explanation from Kik's head of messenger about how this played out: https://medium.com/@mproberts/a-discussion-about-the-breaking-of-the-internet-3d4d2a83aa4d https://medium.com/@mproberts/a-discussion-about-the-breakin... We're sorry for our part in creating the impression that this was anything more than a polite request to use the Kik package name for an upcoming open source project.
  • insin 11y ago
    s/polite request/politely-worded threat/
• turtlekiosk 11y ago
  can i kik it? RIP Phife Dawg
• tytho 11y ago
  Perhaps someone has already suggested this, but what if npm had some sort of "unpublish block" if any modules depended on yours? Or maybe some sort of notification to the dependent package owners. This doesn't solve the issue of unpublishing dependent free packages, nor does it solve someone taking over and putting malicious code, but it would encourage a more responsible behavior when removing a highly depended upon package.
• Top5a 11y ago
  All legality, copyright law, etc. aside, how did this even create a problem? Even on small projects, basic build engineering dictates that you are cognizant of which package versions against which you are building. Furthermore, all packages should be locally cache-isolated on your build server (or local box if you do not have a build server). Building against the most "up-to-date" versions of remote dependencies puts you completely at risk for situations such as this, let alone at the mercy of malicious updates to such remote dependencies. What sane (pun intended) person would ever build against the most recent version of all packages (including small ones such as this) from a remote build server? Also, for larger (i.e. more than several employees) type operations, how could QA possibly function when building from "most recent version of all packages"? All these entities that are suffering because of this should immediately fire all their build engineers, because they are not only a reliability concern, but, more critically, a vulnerability concern.
• KajMagnus 11y ago
  Does this mean that I can no longer safely run `npm update`, or ask anyone to download my Node.js project and tell them to run `npm install`? Because the npm repo has in effect been compromised and is unsafe to use, until further notice? That's what I'm assuming right now anyway. I'm not going to upgrade any Node.js dependencies or run `npm update` or tell anyone to run `npm install`. If you look at the list of liberated libraries ( https://gist.githubusercontent.com/azer/db27417ee84b5f34a6ea/raw/50ab7ef26dbde2d4ea52318a3590af78b2a21162/gistfile1.txt https://gist.githubusercontent.com/azer/db27417ee84b5f34a6ea... ) — it's "impossible" for me to know which ones of all these libs I use indirectly via some other libraries, and ... ...Elsewhere in this discussion: (https://news.ycombinator.com/item?id=11343297 https://news.ycombinator.com/item?id=11343297) > > Is there a plan to address this? > Too late. Every package name on the list has been claimed already by a randomer with unknnown intentions. Sounds dangerous to me. ... And I wish there was some way to get notified, when this issue has been fixed somehow.
• Coxa 11y ago
  Check your project for these liberated modules using (yay) this module https://www.npmjs.com/package/affected https://www.npmjs.com/package/affected
• wangderland 11y ago
  If your project use the packages in the list, and got broken due to this. Here comes a solution https://medium.com/@viktorw/how-to-fix-npm-issues-in-your-projects-after-azer-ko%C3%A7ulu-liberated-his-modules-7368951c2509#.5wiknjg39 https://medium.com/@viktorw/how-to-fix-npm-issues-in-your-pr...