6 ms·

Unless you're npm: https://twitter.com/seldo/status/712414400808755200 https://twitter.com/seldo/status/712414400808755200

seanp2k2 11y ago
ooh gosh, they should really do something like ban new projects from using those names until they figure out a better solution, hopefully with the module author.
- deleted 11y ago
  [deleted]
- deleted 11y ago
  [deleted]
- tobltobs 11y ago
  Seems that we should now prefix any package name with a random string like 'skdjdihsawqy'. This way you could maybe avoid to be the target for some of those 'has to proof itself' lawyers.
  - melvinmt 11y ago
    Or, you know, prefix with author's username, a la Github.
    - tomaskafka 11y ago
      Like, can my github username be kik? And if I have created years before they founded kik?
      - usrusr 11y ago
        How many years before github would that be? (Edit: this was written under the assumption that the lawyers in question are working on behalf of kik, the cheap clothes company, not kik, the messenger company. The original article is unclear about that) This really has to be attacked at the root: let's all stop pretending that a sequence of characters can be owned. Before the web came along, people were completely sane about the protection of brands. Nobody had delusions about string ownership, but deceptive abuse of brand names was suppressed just as well. Enter the web, and suddenly corporations start thinking they somehow deserve exclusivity for their stupid little three-letter-acronym, at first on the DNS, now, apparently, also in search engine hit lists ("oh noes, someone might google themselves onto github instead of our site, people will start wearing NPMs instead of our clothes!").
        fapjacks 11y ago
        Ding Ding Ding!!!
    - danneu 11y ago
      This would solve classes of issues with the npm ecosystem (many of which remind me of trying to register a domain name) like name-squatting, trying to think up a marketable-but-untaken name, and ownership transfer. OP claimed a bunch of sweet dictionary words (concat, iframe, door, bud, alert, map) and new owners are now claiming them and it's a security disaster. But it'd be a lot less interesting if they unpublished "azer/map", "azer/alert", "azer/iframe", etc. and new owners republished under their own names. Elm packages got this right: http://package.elm-lang.org/ http://package.elm-lang.org/
guelo 11y ago
So left-pad is too important to be removed but Kik isn't? What if the author had originally called left-pad Kik? Why is it ok for the Kik trademark holder to break thousands of builds but not the module author?
- artursapek 11y ago
  That's a good point. Very inconsistent behavior by NPM here.
- bluefox 11y ago
  This is a very good question. I was going to make the argument that the author merely continued what NPM Inc. started, and that if you fault him, you should also fault NPM Inc., but then I noticed that NPM Inc. didn't unpublish his module, but transfered the name to another account, which is much worse, if you think about it. The ultimate conclusion is that if it's anyone's fault, it is the fault of the person who relies on NPM Inc. when building his software.
  - newjersey 11y ago
    I'm a known downer of npm and node in general and this illustrates how bad npm is about this... You can't just change owners to kik on npm without the previous maintainer's permission. NPM has violated the trust of the community and will continue to do so until someone forks npm and makes an honest community out of it. What's next? If I have foo.bar domain, can kik come and say I can't have foo.bar/kik or kik.foo.bar? To the people who think npm is right, what if you owned foo.bar and Google decided they didn't want to deal with kik lawyers and redirected kik.foo.bar to kik.com?
  - fungi 11y ago
    couple of days ago i was all smug from upvotes for calling npm best practise. i take that back, npm is a security risk that should be avoided. now i need a new package manager.
    - bluefox 11y ago
BinaryIdiot 11y ago
That's pretty interesting. I wonder if it's within npm's legal right to distribute someone else's IP in such a way that they do not desire. Granted the license is WTFPL but does that include taking over the IP itself?
- krapp 11y ago
  > Granted the license is WTFPL but does that include taking over the IP itself? IANAL but "do whatever the fuck you want to" would seem to include literally everything including taking over the IP.
  - BinaryIdiot 11y ago
    Yeah I get the "do whatever the fuck you want" but in a legal sense I wasn't sure that could (or did) include actual ownership. I thought that had more to do with copyright and any other IP transferring. Then again I also said I had no idea :)
    - krapp 11y ago
      The more I think about this license, the more I wonder if it's even legally enforceable. How do you enforce a license whose only terms are that it has no terms?
      - steveklabnik 11y ago
        The WTFPL's own website mentions that it's never been tested in court.
- girvo 11y ago
  > Granted the license is WTFPL but does that include taking over the IP itself Well, I'm certainly not a lawyer, but I personally think thats in the spirit of the "Do What the Fuck You Want to Public License"... And at the end of the day the IP is still owned by the original author; the distribution of it has changed.
- 11y ago

seanp2k2 11y ago

ooh gosh, they should really do something like ban new projects from using those names until they figure out a better solution, hopefully with the module author.

deleted 11y ago
[deleted]
deleted 11y ago
[deleted]
tobltobs 11y ago
Seems that we should now prefix any package name with a random string like 'skdjdihsawqy'. This way you could maybe avoid to be the target for some of those 'has to proof itself' lawyers.
- melvinmt 11y ago
  Or, you know, prefix with author's username, a la Github.
  - tomaskafka 11y ago
    Like, can my github username be kik? And if I have created years before they founded kik?
    - usrusr 11y ago
      How many years before github would that be? (Edit: this was written under the assumption that the lawyers in question are working on behalf of kik, the cheap clothes company, not kik, the messenger company. The original article is unclear about that) This really has to be attacked at the root: let's all stop pretending that a sequence of characters can be owned. Before the web came along, people were completely sane about the protection of brands. Nobody had delusions about string ownership, but deceptive abuse of brand names was suppressed just as well. Enter the web, and suddenly corporations start thinking they somehow deserve exclusivity for their stupid little three-letter-acronym, at first on the DNS, now, apparently, also in search engine hit lists ("oh noes, someone might google themselves onto github instead of our site, people will start wearing NPMs instead of our clothes!").
      - fapjacks 11y ago
        Ding Ding Ding!!!
  - danneu 11y ago
    This would solve classes of issues with the npm ecosystem (many of which remind me of trying to register a domain name) like name-squatting, trying to think up a marketable-but-untaken name, and ownership transfer. OP claimed a bunch of sweet dictionary words (concat, iframe, door, bud, alert, map) and new owners are now claiming them and it's a security disaster. But it'd be a lot less interesting if they unpublished "azer/map", "azer/alert", "azer/iframe", etc. and new owners republished under their own names. Elm packages got this right: http://package.elm-lang.org/ http://package.elm-lang.org/

guelo 11y ago

So left-pad is too important to be removed but Kik isn't? What if the author had originally called left-pad Kik? Why is it ok for the Kik trademark holder to break thousands of builds but not the module author?

artursapek 11y ago
That's a good point. Very inconsistent behavior by NPM here.
bluefox 11y ago
This is a very good question. I was going to make the argument that the author merely continued what NPM Inc. started, and that if you fault him, you should also fault NPM Inc., but then I noticed that NPM Inc. didn't unpublish his module, but transfered the name to another account, which is much worse, if you think about it. The ultimate conclusion is that if it's anyone's fault, it is the fault of the person who relies on NPM Inc. when building his software.
- newjersey 11y ago
  I'm a known downer of npm and node in general and this illustrates how bad npm is about this... You can't just change owners to kik on npm without the previous maintainer's permission. NPM has violated the trust of the community and will continue to do so until someone forks npm and makes an honest community out of it. What's next? If I have foo.bar domain, can kik come and say I can't have foo.bar/kik or kik.foo.bar? To the people who think npm is right, what if you owned foo.bar and Google decided they didn't want to deal with kik lawyers and redirected kik.foo.bar to kik.com?
- fungi 11y ago
  couple of days ago i was all smug from upvotes for calling npm best practise. i take that back, npm is a security risk that should be avoided. now i need a new package manager.
  - bluefox 11y ago

BinaryIdiot 11y ago

That's pretty interesting. I wonder if it's within npm's legal right to distribute someone else's IP in such a way that they do not desire. Granted the license is WTFPL but does that include taking over the IP itself?

krapp 11y ago
> Granted the license is WTFPL but does that include taking over the IP itself? IANAL but "do whatever the fuck you want to" would seem to include literally everything including taking over the IP.
- BinaryIdiot 11y ago
  Yeah I get the "do whatever the fuck you want" but in a legal sense I wasn't sure that could (or did) include actual ownership. I thought that had more to do with copyright and any other IP transferring. Then again I also said I had no idea :)
  - krapp 11y ago
    The more I think about this license, the more I wonder if it's even legally enforceable. How do you enforce a license whose only terms are that it has no terms?
    - steveklabnik 11y ago
      The WTFPL's own website mentions that it's never been tested in court.
girvo 11y ago
> Granted the license is WTFPL but does that include taking over the IP itself Well, I'm certainly not a lawyer, but I personally think thats in the spirit of the "Do What the Fuck You Want to Public License"... And at the end of the day the IP is still owned by the original author; the distribution of it has changed.
11y ago