8 ms·

> And... I kind of want to say "once it's published, it's forever". This is effectively the norm with more traditional, curated package managers. Say I release

> And... I kind of want to say "once it's published, it's forever". This is effectively the norm with more traditional, curated package managers. Say I release a piece of open source software, and some Linux distro adds it to their package manager. Under a typical open source license, I have no legal right to ask them to stop distributing it. They can just say "sorry, you licensed this code to us under X license and we're distributing it under those terms. Removing it would break our users' systems, so we won't do it." The difference is that NPM is self-service - publishers add packages themselves, and NPM has chosen to also provide a self-service option to remove packages. I honestly wouldn't have a problem with them removing that option, and only allowing packages to be removed by contacting support with a good reason. (Accidental private info disclosure, copyright violation, severe security bug, etc.)

echelon 11y ago
I honestly wouldn't have a problem with them removing that option, and only allowing packages to be removed by contacting support with a good reason. (Accidental private info disclosure, copyright violation, severe security bug, etc.) Even Rust's Cargo won't allow you to revoke secrets [1]. I think this is the correct policy. [1] http://doc.crates.io/crates-io.html#cargo-yank http://doc.crates.io/crates-io.html#cargo-yank
- drewgross 11y ago
  Aside from secrets there is also sensitive data. If someone accidentally uploads some personal information, they need a way to remove it if, say, they receive a court order ordering them to remove it.
  - Joky 11y ago
    I'm not sure how the court could force you to do something you can't possibly do...
    - jzwinck 11y ago
      They would force the provider to facilitate the removal.
    - patio11 11y ago
      "So what you're saying is, your computers cannot possibly not continue damaging the plaintiff's interests." "That's correct." "You're being honest with me." "Yes, your Honor." "Will the computers continue harming the plaintiff's interests if shut off?" "... That would be dreadfully inconvenient, your Honor." "Do you have a more convenient solution?" "No, your Honor." "You are hereby ordered to turn off your computers in 48 hours." "... You can't do that." "I can do a lot of things, including jailing you if you disobey my lawful authority. 48 hours." Engineers often think that they are the first people in history to have thought "Hey, wouldn't it be easy to pull one over on the legal system?" This is, in fact, quite routine. The legal system interprets attempts to route around it as damage and responds to damage with overwhelming force.
      - indiv0 11y ago
        How about a blockchain-based NPM? Can't take all the computers down. Legal, shmegal.
        repomies69 11y ago
        Yep, but someone should implement that first. Package repositories have pretty much centralized control still, and will have for foreseeable future.
        ubernostrum 11y ago
        You can still be jailed for contempt of the order, though. "I've found a clever workaround for court orders" doesn't work around that bit.
        iopq 11y ago
        OK, now tell me how you can remove this file from BitTorrent (it's Fedora 18 KDE) magnet:?xt=urn:btih:14f146cdfaef83951ca9d3ac647e18e1977d1367 I'll wait
  - kibwen 11y ago
    This why sites that don't allow package authors to "unpublish" have contact information so that data deletion can be handled on a case-by-case basis.
  - appleflaxen 11y ago
    If they receive a court order, and there is no technical way to do that, then the court is out of luck. "A court might order it in the future" is not a design constraint on your decisions today.
    - sveiss 11y ago
      Sure there's a technical way to do it: you unplug the server hosting it (or more likely, your hosting provider does that for you). No court is going to shed any tears over fact this has wider consequences than if you'd been able to comply with a narrower takedown request.
      - rboyd 11y ago
        This combined with the cost of hosting (I remember the ruby community freaking out over rubygems costs a couple years ago) makes me think maybe we're evolving towards decentralized dependency hosting. Something like Storj where users offset hosting fees with blockchain payments when dependencies are fetched.
        krakensden 11y ago
        The go solution seems more reasonable and achievable- the host is part of the namespace. Instant decentralization.
        jessaustin 11y ago
        There's nothing preventing decentralization with npm now; it's a matter of configuration. Tying the namespace to a host seems more like instant excessive coupling.
        Spivak 11y ago
        Tying namespaces to a hostname isn't really that controversial -- it's no different than email. If you want to be your own provider then host your packages on your server(s) and tell your users to add npm.cooldev.me/packagename to their configuration. If you don't want to host your own then you can choose from a few public providers like npmjs but then have to be subject to their guidelines, policies, and fees. Throw in some automatic bittorrent support in the client to help offload costs and you've got something great.
- deleted 11y ago
  [deleted]
deleted 11y ago
[deleted]

echelon 11y ago

I honestly wouldn't have a problem with them removing that option, and only allowing packages to be removed by contacting support with a good reason. (Accidental private info disclosure, copyright violation, severe security bug, etc.) Even Rust's Cargo won't allow you to revoke secrets [1]. I think this is the correct policy. [1] http://doc.crates.io/crates-io.html#cargo-yank http://doc.crates.io/crates-io.html#cargo-yank

drewgross 11y ago
Aside from secrets there is also sensitive data. If someone accidentally uploads some personal information, they need a way to remove it if, say, they receive a court order ordering them to remove it.
- Joky 11y ago
  I'm not sure how the court could force you to do something you can't possibly do...
  - jzwinck 11y ago
    They would force the provider to facilitate the removal.
  - patio11 11y ago
    "So what you're saying is, your computers cannot possibly not continue damaging the plaintiff's interests." "That's correct." "You're being honest with me." "Yes, your Honor." "Will the computers continue harming the plaintiff's interests if shut off?" "... That would be dreadfully inconvenient, your Honor." "Do you have a more convenient solution?" "No, your Honor." "You are hereby ordered to turn off your computers in 48 hours." "... You can't do that." "I can do a lot of things, including jailing you if you disobey my lawful authority. 48 hours." Engineers often think that they are the first people in history to have thought "Hey, wouldn't it be easy to pull one over on the legal system?" This is, in fact, quite routine. The legal system interprets attempts to route around it as damage and responds to damage with overwhelming force.
    - indiv0 11y ago
      How about a blockchain-based NPM? Can't take all the computers down. Legal, shmegal.
      - repomies69 11y ago
        Yep, but someone should implement that first. Package repositories have pretty much centralized control still, and will have for foreseeable future.
      - ubernostrum 11y ago
        You can still be jailed for contempt of the order, though. "I've found a clever workaround for court orders" doesn't work around that bit.
        iopq 11y ago
        OK, now tell me how you can remove this file from BitTorrent (it's Fedora 18 KDE) magnet:?xt=urn:btih:14f146cdfaef83951ca9d3ac647e18e1977d1367 I'll wait
- kibwen 11y ago
  This why sites that don't allow package authors to "unpublish" have contact information so that data deletion can be handled on a case-by-case basis.
- appleflaxen 11y ago
  If they receive a court order, and there is no technical way to do that, then the court is out of luck. "A court might order it in the future" is not a design constraint on your decisions today.
  - sveiss 11y ago
    Sure there's a technical way to do it: you unplug the server hosting it (or more likely, your hosting provider does that for you). No court is going to shed any tears over fact this has wider consequences than if you'd been able to comply with a narrower takedown request.
    - rboyd 11y ago
      This combined with the cost of hosting (I remember the ruby community freaking out over rubygems costs a couple years ago) makes me think maybe we're evolving towards decentralized dependency hosting. Something like Storj where users offset hosting fees with blockchain payments when dependencies are fetched.
      - krakensden 11y ago
        The go solution seems more reasonable and achievable- the host is part of the namespace. Instant decentralization.
        jessaustin 11y ago
        There's nothing preventing decentralization with npm now; it's a matter of configuration. Tying the namespace to a host seems more like instant excessive coupling.
        Spivak 11y ago
        Tying namespaces to a hostname isn't really that controversial -- it's no different than email. If you want to be your own provider then host your packages on your server(s) and tell your users to add npm.cooldev.me/packagename to their configuration. If you don't want to host your own then you can choose from a few public providers like npmjs but then have to be subject to their guidelines, policies, and fees. Throw in some automatic bittorrent support in the client to help offload costs and you've got something great.
deleted 11y ago
[deleted]

deleted 11y ago

[deleted]