5 ms·

FYI I'm the one who republished left-pad after it was unpublished. I think of it similar to letting a domain name expire. The original author removed the code

by camwest 11y ago

FYI I'm the one who republished left-pad after it was unpublished. I think of it similar to letting a domain name expire. The original author removed the code and I forked it and published a new version with the same package name. The main issue was there were so many hard coded dependencies to 0.0.3 so I asked npm support if they could allow me to re-publish that version and they complied since I was now the maintainer of that package.

jlg23 11y ago
Thank you for fixing something that should have never been an issue. You allowed many developers to have a life after work :)
kzrdude 11y ago
Obviously not your choice, but it's a problem of using 0.0.x versions; no flexibility for the crate author to push minor updates.
- krainboltgreene 11y ago
  That's absolutely not true.
  - kzrdude 11y ago
    The fact that so many depend on exactly the version 0.0.3 indicates it is. What if it were 0.3.0 instead? The common dependency relation would allow 0.3.1 too and allow you to easily deliver a minor update.
- lmm 11y ago
  If you want the flexibility of pushing minor updates the flipside is you need to provide a definition of what constitutes minor - at which point you should be on 1.x.
shruubi 11y ago
While I can appreciate the predicament this presents, do you not feel like you are going against the wishes of the original author by essentially overtaking him and publishing his code against his will?
- krapp 11y ago
  The author's explicit wishes, in no uncertain terms, are that anyone can "do what the fuck they want to with it" [0][1]. I think when he did this, he gave up (willingly, and with a bit of profanity) the right to have any say at all about whether, how or by whom it was published. [0]http://www.wtfpl.net/ http://www.wtfpl.net/ [1]https://github.com/azer/left-pad/blob/master/package.json#L24 https://github.com/azer/left-pad/blob/master/package.json#L2...
  - perennate 11y ago
    The author also said "if you volunteer to take ownership of any module in my Github, I’ll happily transfer the ownership" in the blog post.
    - krapp 11y ago
      Which is a nice gesture, but since the wtfpl seems to give up any pretense of ownership on the part of the author, it's also irrelevant. Anyone can do what they want with it. If he wanted to keep tighter control of the code he should have published under a more restrictive license. And, if he wanted people to take the time to be polite and contact him through his github account, maybe he shouldn't have wrecked so many people's builds.
      - perennate 11y ago
        The "ownership" I assume is referring to ownership on npm. I was just saying that, based on that excerpt from the blog post, it sounds like the author didn't actually want to keep tighter control of the code, and that re-publishing the code doesn't really go against the author's wishes.
ploxiln 11y ago
So if I understand correctly * npm allows a module to be deleted so all fetches of published name-oldversion fail * npm allows you to take-over the name of a deleted module and publish name-newversion * npm does not allow you to "re-publish" name-oldversion which had existed before the deletion but npm ops forced this publish for your special case That's a strange combination of constraints. If you're going to reserve the name-oldversion permanently, you might as well leave the content there too. (Except, I guess, for license compliance...)
- camwest 11y ago
  Yes you got it right. The third point was the special exception / grey area. For the record they made sure the exact same code was published to 0.0.3 so that I didn't maliciously inject anything. I control subsequent versions though.
  - tdicola 11y ago
    Now that you own it what's to stop you from pushing out a new version with a slightly reworked string pad function under a commercial license (say a $100 per use fee)? Could make quite a pretty penny. Kind of crazy that this is possible at all.
    - camwest 11y ago
      People can still just use the older versions that are immutable.
      - heavenlyhash 11y ago
        Except this very same string of events makes it quite obvious that versions aren't systematically immutable. And vast numbers of people are suddenly shocked (shocked!) to realize there's no mechanical verification of stuff like this. It can all happen whimsically, and the result isn't just a loss of service, it's service with different results and no verification nor notice.

by camwest 11y ago

jlg23 11y ago

Thank you for fixing something that should have never been an issue. You allowed many developers to have a life after work :)

kzrdude 11y ago

Obviously not your choice, but it's a problem of using 0.0.x versions; no flexibility for the crate author to push minor updates.

krainboltgreene 11y ago
That's absolutely not true.
- kzrdude 11y ago
  The fact that so many depend on exactly the version 0.0.3 indicates it is. What if it were 0.3.0 instead? The common dependency relation would allow 0.3.1 too and allow you to easily deliver a minor update.
lmm 11y ago
If you want the flexibility of pushing minor updates the flipside is you need to provide a definition of what constitutes minor - at which point you should be on 1.x.

shruubi 11y ago

While I can appreciate the predicament this presents, do you not feel like you are going against the wishes of the original author by essentially overtaking him and publishing his code against his will?

krapp 11y ago
The author's explicit wishes, in no uncertain terms, are that anyone can "do what the fuck they want to with it" [0][1]. I think when he did this, he gave up (willingly, and with a bit of profanity) the right to have any say at all about whether, how or by whom it was published. [0]http://www.wtfpl.net/ http://www.wtfpl.net/ [1]https://github.com/azer/left-pad/blob/master/package.json#L24 https://github.com/azer/left-pad/blob/master/package.json#L2...
- perennate 11y ago
  The author also said "if you volunteer to take ownership of any module in my Github, I’ll happily transfer the ownership" in the blog post.
  - krapp 11y ago
    Which is a nice gesture, but since the wtfpl seems to give up any pretense of ownership on the part of the author, it's also irrelevant. Anyone can do what they want with it. If he wanted to keep tighter control of the code he should have published under a more restrictive license. And, if he wanted people to take the time to be polite and contact him through his github account, maybe he shouldn't have wrecked so many people's builds.
    - perennate 11y ago
      The "ownership" I assume is referring to ownership on npm. I was just saying that, based on that excerpt from the blog post, it sounds like the author didn't actually want to keep tighter control of the code, and that re-publishing the code doesn't really go against the author's wishes.

ploxiln 11y ago

So if I understand correctly * npm allows a module to be deleted so all fetches of published name-oldversion fail * npm allows you to take-over the name of a deleted module and publish name-newversion * npm does not allow you to "re-publish" name-oldversion which had existed before the deletion but npm ops forced this publish for your special case That's a strange combination of constraints. If you're going to reserve the name-oldversion permanently, you might as well leave the content there too. (Except, I guess, for license compliance...)

camwest 11y ago
Yes you got it right. The third point was the special exception / grey area. For the record they made sure the exact same code was published to 0.0.3 so that I didn't maliciously inject anything. I control subsequent versions though.
- tdicola 11y ago
  Now that you own it what's to stop you from pushing out a new version with a slightly reworked string pad function under a commercial license (say a $100 per use fee)? Could make quite a pretty penny. Kind of crazy that this is possible at all.
  - camwest 11y ago
    People can still just use the older versions that are immutable.
    - heavenlyhash 11y ago
      Except this very same string of events makes it quite obvious that versions aren't systematically immutable. And vast numbers of people are suddenly shocked (shocked!) to realize there's no mechanical verification of stuff like this. It can all happen whimsically, and the result isn't just a loss of service, it's service with different results and no verification nor notice.