5 ms·

So wait...if I decided I want to remove my work from the internet and become a recluse, I'll have to get permission from Isaacs? What if I just don't want to b

by _Marak_ 11y ago

So wait...if I decided I want to remove my work from the internet and become a recluse, I'll have to get permission from Isaacs? What if I just don't want to be bothered anymore by developers looking for support on my projects? NPM jumped the shark a year or so ago. A package manager shouldn't be a ventured capital funded business. We are all going to suffer from Isaac's leadership on NPM.

steveklabnik 11y ago
This is how open source code works. It has nothing to do with Isaacs, npm, or how npm is funded. Once you give a bit of software to someone with an open source license, they can continue to distribute it to other people, even if you stop distributing it yourself. This is crucial to how the whole thing works.
- _Marak_ 11y ago
  I really like NPM. It's awesome.
  - steveklabnik 11y ago
    This has always been the case, and if you'd like to be able to revoke distribution rights from someone at a later time, you'd need to put that in your license terms. No major open source license that I'm aware of features such a clause.
    - LamaOfRuin 11y ago
      You don't have to use a standard open source license. In fact it appears you can have packages on NPM with no specified license.
      - steveklabnik 11y ago
        To be clear as to what you're saying: npm does not require you to use a standard license. This is true. So in those cases, it would be different. That's my point: you'd have to specifically use a license which had this term in it. left-pad, for example, did not have this clause.
        LamaOfRuin 11y ago
        It's unclear to me they had the right with left-pad. https://github.com/azer/left-pad https://github.com/azer/left-pad has no license file, and the license in package.json is meaningless. I can interpret it as referring to anything I want with the same acronym. I agree that the spirit from the author seems to have been to allow this re-publishing, and I don't really think npm did anything wrong by doing so, but that's not generally applicable in the way their new policy is. I think their lawyers should have a serious problem with this new policy.
        steveklabnik 11y ago
        I'm not 100% sure if there's ever been rulings about metadata vs in-tree, but agree having it in-tree as well would be helpful. npm's lawyers were intimately involved in this new policy, so I can assure you they don't have a problem with it.
        LamaOfRuin 11y ago
        hmm, I mean, I guess there's no harm having it be stated policy. There are any number of hypothetical situations where I'd expect their lawyers to advise them not to follow that policy when faced with the threat of litigation.
        pfooti 11y ago
        The license in package.json seems to refer to http://www.wtfpl.net/ http://www.wtfpl.net/
        wyldfire 11y ago
        But as copyright holder you're not bound to use that license ever-after. You can change the terms for all versions to be "strictly proprietary." I would love to hear from a lawyer but I would speculate that it would mean that you would effectively subject yourself to infringement if you published a derived work even if those terms changed after your publication.
  - choward 11y ago
    You can edit your name and email address. You can also update all your READMEs to say you no longer support the project. It's a lot better than breaking everyone's projects.
  - chadly 11y ago
    Your "control" of your code is an illusion if you publish it as open source. This policy now makes clear the way it already works (or should have in the case of last week).
  - profmonocle 11y ago
    > Now they are telling me I don't have control over my own content in their directory. Because that's literally true. You chose to relinquish that control when you published under a free software license. This isn't limited to NPM. Say you publish an application on GitHub, and Debian decides to add it to their package manager. If you take down your GitHub repo, it'll still be in Debian's repository. If you ask Debian to remove it, they'll likely say no.
  - dalore 11y ago
    That's how pretty much every directory on the internet operates. A directory can list free information about anything. If you're publishing open source code that's free information. Directories don't have to take down information that's freely available. If I wanted to create a directory of open source code on the internet I'm free to copy and host that open source code as long I keep the open source license on it. Authors could request it to be taken down, removed etc but under the open source license I'm free to keep it up and ignore them. If I wanted to create a directory of Starbucks locations I could and starbucks could not take it down either.
- underbluewaters 11y ago
  Exactly. If you open source your code you are giving up certain rights to control that code. If you are having any reservations about that, everyone will be a lot better off if you just don't publish modules in npm.
- tomjen3 11y ago
  Does NPM require you to only publish open source code? Can I publish a package that allows you to download it from NPM but requires you to get a license from me to run it? How about a limited open license that only allows straight white women to run the software?
  - steveklabnik 11y ago
    They do not. I am speaking solely about the usual open source licenses here, which are the vast, vast majority of packages. Your hypothetical limited license is not open source nor free software, so it's out of the scope of my point here. If you did publish some code on npm with such a license, their TOS covers npm's ability to distribute that code to end-users, who may or may not be allowed to actually run your code, per the license. But then your issue would be with those users, not npm Inc.
  - michaelmrose 11y ago
    Wouldn't it be a bit unrealistic to try to enforce this?
gkoberger 11y ago
So wait...if I depend on a package but the developer randomly wants to remove his work from the Internet and become a recluse, my entire site breaks? What if I just don't want to be bothered anymore by having to rewrite entire modules I depended on? NPM jumped the shark a year or so ago. A package manager vitally depended on should be forced to work for free. We are all going to suffer from Isaac's leadership on NPM.
- _Marak_ 11y ago
  If you are depending on another persons package and haven't bothered to lock in a version or bundle the version into your application, your site is not your site. If you want to depend on other's peoples work without taking care to insulate yourself, you'll have to deal with it. Why is it none of my applications were affected by `left-pad` this week? Good question. NPM had plenty of chances for realistic ( non-venture capital based ) funding. They took too much cash and hired too many people. Now everything is starting to fall apart.
  - gkoberger 11y ago
    So, if you're okay with me locking a package myself... why can't NPM just do the locking for me? That's what's happening with this new change. After all, I'm not a developer because I like administrative work – I want to build stuff, and NPM takes the hassle out of this.
- chris_wot 11y ago
  Wow. Just wow. Before npm you'd grab a tarball and keep a copy in an external modules directory. If the author pulled their work, you'd keep using that tarball, and eventually migrate to another package. But agreed. Isaacs seems to do quite a few unilateral changes that cause a hell of a lot of disruption.
  - _Marak_ 11y ago
    If you remember the actual history of NPM, you will remember that TJ had a competing package manager called "kiwi" which was entirely github / git / and bash based ( using semver ). Nodejitsu ( me ) choose to back NPM over Kiwi starting in 2009. It's all public information if you start crawling through emails.
zem 11y ago
i'd like to see an "orphan" command that just stripped your name and contact info off the package, registered it to a "node-orphaned-package" user as a signal that it was unmaintained, and prevented anyone else from using the name (i.e. adopting an orphaned package would require changing its name, with node supplying tools to track the transition).
tomjen3 11y ago
You would have to get permission from NPM yes. However ten yearz ago you wouldn't be able to it at all, since you would have to hunt down everybody who had a copy of your source code. If you don't want to be bothered by support requests, you can just ignore them - nobody owes anybody anything but what you have mutually agreed to - offer consulting about the problem to them at exorbitant rates (say 10k/hour, which is worth it for large enough businesses with my-hair-is-on-fire problems) or whatever else you want. If you have your own domain you can use a throw-away email address and just drop all email sent to it. However the open source licence you published under specified that you gave away a non-revocable, permanent license so of course you can't demand others delete files on their systems.

by _Marak_ 11y ago

steveklabnik 11y ago

This is how open source code works. It has nothing to do with Isaacs, npm, or how npm is funded. Once you give a bit of software to someone with an open source license, they can continue to distribute it to other people, even if you stop distributing it yourself. This is crucial to how the whole thing works.

_Marak_ 11y ago
I really like NPM. It's awesome.
- steveklabnik 11y ago
  This has always been the case, and if you'd like to be able to revoke distribution rights from someone at a later time, you'd need to put that in your license terms. No major open source license that I'm aware of features such a clause.
  - LamaOfRuin 11y ago
    You don't have to use a standard open source license. In fact it appears you can have packages on NPM with no specified license.
    - steveklabnik 11y ago
      To be clear as to what you're saying: npm does not require you to use a standard license. This is true. So in those cases, it would be different. That's my point: you'd have to specifically use a license which had this term in it. left-pad, for example, did not have this clause.
      - LamaOfRuin 11y ago
        It's unclear to me they had the right with left-pad. https://github.com/azer/left-pad https://github.com/azer/left-pad has no license file, and the license in package.json is meaningless. I can interpret it as referring to anything I want with the same acronym. I agree that the spirit from the author seems to have been to allow this re-publishing, and I don't really think npm did anything wrong by doing so, but that's not generally applicable in the way their new policy is. I think their lawyers should have a serious problem with this new policy.
        steveklabnik 11y ago
        I'm not 100% sure if there's ever been rulings about metadata vs in-tree, but agree having it in-tree as well would be helpful. npm's lawyers were intimately involved in this new policy, so I can assure you they don't have a problem with it.
        LamaOfRuin 11y ago
        hmm, I mean, I guess there's no harm having it be stated policy. There are any number of hypothetical situations where I'd expect their lawyers to advise them not to follow that policy when faced with the threat of litigation.
        pfooti 11y ago
        The license in package.json seems to refer to http://www.wtfpl.net/ http://www.wtfpl.net/
      - wyldfire 11y ago
        But as copyright holder you're not bound to use that license ever-after. You can change the terms for all versions to be "strictly proprietary." I would love to hear from a lawyer but I would speculate that it would mean that you would effectively subject yourself to infringement if you published a derived work even if those terms changed after your publication.
- choward 11y ago
  You can edit your name and email address. You can also update all your READMEs to say you no longer support the project. It's a lot better than breaking everyone's projects.
- chadly 11y ago
  Your "control" of your code is an illusion if you publish it as open source. This policy now makes clear the way it already works (or should have in the case of last week).
- profmonocle 11y ago
  > Now they are telling me I don't have control over my own content in their directory. Because that's literally true. You chose to relinquish that control when you published under a free software license. This isn't limited to NPM. Say you publish an application on GitHub, and Debian decides to add it to their package manager. If you take down your GitHub repo, it'll still be in Debian's repository. If you ask Debian to remove it, they'll likely say no.
- dalore 11y ago
  That's how pretty much every directory on the internet operates. A directory can list free information about anything. If you're publishing open source code that's free information. Directories don't have to take down information that's freely available. If I wanted to create a directory of open source code on the internet I'm free to copy and host that open source code as long I keep the open source license on it. Authors could request it to be taken down, removed etc but under the open source license I'm free to keep it up and ignore them. If I wanted to create a directory of Starbucks locations I could and starbucks could not take it down either.
underbluewaters 11y ago
Exactly. If you open source your code you are giving up certain rights to control that code. If you are having any reservations about that, everyone will be a lot better off if you just don't publish modules in npm.
tomjen3 11y ago
Does NPM require you to only publish open source code? Can I publish a package that allows you to download it from NPM but requires you to get a license from me to run it? How about a limited open license that only allows straight white women to run the software?
- steveklabnik 11y ago
  They do not. I am speaking solely about the usual open source licenses here, which are the vast, vast majority of packages. Your hypothetical limited license is not open source nor free software, so it's out of the scope of my point here. If you did publish some code on npm with such a license, their TOS covers npm's ability to distribute that code to end-users, who may or may not be allowed to actually run your code, per the license. But then your issue would be with those users, not npm Inc.
- michaelmrose 11y ago
  Wouldn't it be a bit unrealistic to try to enforce this?

gkoberger 11y ago

So wait...if I depend on a package but the developer randomly wants to remove his work from the Internet and become a recluse, my entire site breaks? What if I just don't want to be bothered anymore by having to rewrite entire modules I depended on? NPM jumped the shark a year or so ago. A package manager vitally depended on should be forced to work for free. We are all going to suffer from Isaac's leadership on NPM.

_Marak_ 11y ago
If you are depending on another persons package and haven't bothered to lock in a version or bundle the version into your application, your site is not your site. If you want to depend on other's peoples work without taking care to insulate yourself, you'll have to deal with it. Why is it none of my applications were affected by `left-pad` this week? Good question. NPM had plenty of chances for realistic ( non-venture capital based ) funding. They took too much cash and hired too many people. Now everything is starting to fall apart.
- gkoberger 11y ago
  So, if you're okay with me locking a package myself... why can't NPM just do the locking for me? That's what's happening with this new change. After all, I'm not a developer because I like administrative work – I want to build stuff, and NPM takes the hassle out of this.
chris_wot 11y ago
Wow. Just wow. Before npm you'd grab a tarball and keep a copy in an external modules directory. If the author pulled their work, you'd keep using that tarball, and eventually migrate to another package. But agreed. Isaacs seems to do quite a few unilateral changes that cause a hell of a lot of disruption.
- _Marak_ 11y ago
  If you remember the actual history of NPM, you will remember that TJ had a competing package manager called "kiwi" which was entirely github / git / and bash based ( using semver ). Nodejitsu ( me ) choose to back NPM over Kiwi starting in 2009. It's all public information if you start crawling through emails.

zem 11y ago

i'd like to see an "orphan" command that just stripped your name and contact info off the package, registered it to a "node-orphaned-package" user as a signal that it was unmaintained, and prevented anyone else from using the name (i.e. adopting an orphaned package would require changing its name, with node supplying tools to track the transition).

tomjen3 11y ago

You would have to get permission from NPM yes. However ten yearz ago you wouldn't be able to it at all, since you would have to hunt down everybody who had a copy of your source code. If you don't want to be bothered by support requests, you can just ignore them - nobody owes anybody anything but what you have mutually agreed to - offer consulting about the problem to them at exorbitant rates (say 10k/hour, which is worth it for large enough businesses with my-hair-is-on-fire problems) or whatever else you want. If you have your own domain you can use a throw-away email address and just drop all email sent to it. However the open source licence you published under specified that you gave away a non-revocable, permanent license so of course you can't demand others delete files on their systems.