7 ms·
Aside from secrets there is also sensitive data. If someone accidentally uploads some personal information, they need a way to remove it if, say, they receive a
by drewgross 11y ago
Aside from secrets there is also sensitive data. If someone accidentally uploads some personal information, they need a way to remove it if, say, they receive a court order ordering them to remove it.
- Joky 11y agoI'm not sure how the court could force you to do something you can't possibly do...
- jzwinck 11y agoThey would force the provider to facilitate the removal.
- patio11 11y ago"So what you're saying is, your computers cannot possibly not continue damaging the plaintiff's interests." "That's correct." "You're being honest with me." "Yes, your Honor." "Will the computers continue harming the plaintiff's interests if shut off?" "... That would be dreadfully inconvenient, your Honor." "Do you have a more convenient solution?" "No, your Honor." "You are hereby ordered to turn off your computers in 48 hours." "... You can't do that." "I can do a lot of things, including jailing you if you disobey my lawful authority. 48 hours." Engineers often think that they are the first people in history to have thought "Hey, wouldn't it be easy to pull one over on the legal system?" This is, in fact, quite routine. The legal system interprets attempts to route around it as damage and responds to damage with overwhelming force.
- indiv0 11y agoHow about a blockchain-based NPM? Can't take all the computers down. Legal, shmegal.
- repomies69 11y agoYep, but someone should implement that first. Package repositories have pretty much centralized control still, and will have for foreseeable future.
- ubernostrum 11y agoYou can still be jailed for contempt of the order, though. "I've found a clever workaround for court orders" doesn't work around that bit.
- iopq 11y agoOK, now tell me how you can remove this file from BitTorrent (it's Fedora 18 KDE) magnet:?xt=urn:btih:14f146cdfaef83951ca9d3ac647e18e1977d1367 I'll wait
- ubernostrum 11y agoIt's not about whether the removal is logistically possible, it's about whether a court can punish someone for failing to carry out the removal. Even when the former is actually impossible, a court could still punish for the latter. "Ha ha ha I use technology to cleverly show how futile your orders are" is not the kind of thing you want to say to a court with broad contempt powers.
- toyg 11y agoIf the "forbidden" action was previous to proceedings and carried out in good faith by unknown parties, it would be very hard to sanction anyone.
- iopq 11y agoThe court can't punish you for not being able to do the impossible. That's ludicrous. "We have shut down all of our servers, yes. We can't stop people from downloading this, no"
- mdpopescu 11y agoOr something like http://ipfs.io/ http://ipfs.io/
- repomies691 11y agoIFPS is cool, however pretty far away from being usable as a package management system... Some package management system could use it as a backend, though.
- NoGravitas 11y agoIn fact, gx[0] is such a package management system. [0]: https://github.com/whyrusleeping/gx https://github.com/whyrusleeping/gx
- lugg 11y agoHuh NPM already handles git? http://ipfs.io/ipfs/QmTkzDwWqPbnAh5YiV5VwcTLnGdwSNsNTn2aDxdXBFca7D/example#/ipfs/QmQwAP9vFjbCtKvD8RkJdCvPHqLQjZfW7Mqbbqx18zd8j7/git/readme.md http://ipfs.io/ipfs/QmTkzDwWqPbnAh5YiV5VwcTLnGdwSNsNTn2aDxdX...
- BillinghamJ 11y agonpm already replicates to hundreds of other servers. Right now, it is practically infeasible to actually remove packages permanently.
- deleted 11y ago[deleted]
- oblio 11y ago> The legal system interprets attempts to route around it as damage and responds to damage with overwhelming force. In other words, Hulk Hogan vs Gawker.
- dctoedt 11y agoWhat Patrick says is technically true. But before granting the "extraordinary remedy" of an injunction, U.S. courts would apply the traditional four-factor test, which includes assessing: + the balance of hardships between allowing the conduct in question to continue vs. issuing the injunction; + whether the damage being caused by the conduct in question could be satisfactorily remedied by a payment of money as opposed to a mandate or a prohibition; and + (importantly) the public interest. See, e.g., the Supreme Court's discussion of the four-factor test in eBay v. MercExchange, 547 U.S. 388 (2006), https://scholar.google.com/scholar_case?case=4819344338954570996 https://scholar.google.com/scholar_case?case=481934433895457...
- kefka 11y agoThat's why I'm looking into IPFS(https://ipfs.io https://ipfs.io) as part of my infrastructure. How that would look then, with IPFS... > "So what you're saying is, your computers cannot possibly not continue damaging the plaintiff's interests." "That's correct." > "You're being honest with me." "Yes, your Honor." > "Will the computers continue harming the plaintiff's interests if shut off?" "No it wouldn't, your Honor."..... And suddenly things like NPM can transfer the data to other machines, and those machines themselves can also provide to others. Deletions are impossible if people still want the content. And IPFS guarantees that if a single node has the data, then any node can download it and also be part of the cloud that provides the data. Once it's out, it's impossible to retract.
- kibwen 11y agoThis why sites that don't allow package authors to "unpublish" have contact information so that data deletion can be handled on a case-by-case basis.
- appleflaxen 11y agoIf they receive a court order, and there is no technical way to do that, then the court is out of luck. "A court might order it in the future" is not a design constraint on your decisions today.
- sveiss 11y agoSure there's a technical way to do it: you unplug the server hosting it (or more likely, your hosting provider does that for you). No court is going to shed any tears over fact this has wider consequences than if you'd been able to comply with a narrower takedown request.
- rboyd 11y agoThis combined with the cost of hosting (I remember the ruby community freaking out over rubygems costs a couple years ago) makes me think maybe we're evolving towards decentralized dependency hosting. Something like Storj where users offset hosting fees with blockchain payments when dependencies are fetched.
- krakensden 11y agoThe go solution seems more reasonable and achievable- the host is part of the namespace. Instant decentralization.
- jessaustin 11y agoThere's nothing preventing decentralization with npm now; it's a matter of configuration. Tying the namespace to a host seems more like instant excessive coupling.
- Spivak 11y agoTying namespaces to a hostname isn't really that controversial -- it's no different than email. If you want to be your own provider then host your packages on your server(s) and tell your users to add npm.cooldev.me/packagename to their configuration. If you don't want to host your own then you can choose from a few public providers like npmjs but then have to be subject to their guidelines, policies, and fees. Throw in some automatic bittorrent support in the client to help offload costs and you've got something great.