3 ms·

I don't mean to sound so cynical, but anyone can say "our lawyer". When we wanted to make a change to our own agreements for our training services, our attorney

I don't mean to sound so cynical, but anyone can say "our lawyer". When we wanted to make a change to our own agreements for our training services, our attorney said that any reference to an agreement or license must be styled in a way that makes it "official" (I'm paraphrasing here). Saying "you license npm to provide Your Content" and then referring to it as "npm's special license" is unclear, and thus difficult to enforce, when it's not called a "special license" in the first place, or styled something like "But at a minimum, you license npm to provide Your Content to users of npm Services when you share Your Content ("Special License")." Really, it should've read "You hereby grant npm, Inc. a worldwide, non-exclusive, royalty-free, sublicenseable and transferable license to use, reproduce, distribute, and display Your Content in connection with the services and web sites owned or operated by npm, Inc., its successors and its affiliates." I think I'll suggest that in a PR.

steveklabnik 11y ago
The author of that PR is literally npm's laywer, https://kemitchell.com/cv.html https://kemitchell.com/cv.html > The University of Texas School of Law, Juris Doctor with Honors > State Bar of California, Attorney Member
- spdustin 11y ago
  I stand corrected. I also submitted a PR that, since he's an attorney, can be evaluated for legal enforceability. I think it more clearly specifies the rights granted to npm, and is a nearly verbatim quote from the terms of a consulting agreement we've used with some clients in the past where we are hosting materials they create.
  - steveklabnik 11y ago
    I agree that skepticism is healthy :) I'm sure they'll appreciate the PR.
  - screature2 11y ago
    I like the call out to ("Special License"). However, I think that in defining how npm can use posted code, the existing language is substantially more lenient than the suggested language in your final paragraph. Current text "...That special license allows npm to copy, publish, and analyze Your Content, and to share its analyses with others. npm may run computer code in Your Content to analyze it, but npm's special license alone does not give npm the right to run code for its functionality in npm products or services." (emphasis added) vs suggested text "You hereby grant npm, Inc. a worldwide, non-exclusive, royalty-free, __sublicenseable and transferable license to use, reproduce, distribute, and display Your Content in connection with the services and web sites owned or operated by npm, Inc., its successors and its affiliates." (emphasis added). Your secondary language looks like it further grants npm the right to not only use, but also sell, transfer, and sublicense any code posted to it because the 'in connection with the services and websites...' restriction seems very loose (e.g. why wouldn't selling to support the services be related?). Pretty sure that's not what npm or anyone posting packages to npm wants.
icebraining 11y ago
IANAL, but there's such thing as an implied license. If you upload a package to a service which has the single purpose of redistributing it to others, it's doubtful that you can then argue that you were damaged by such distribution. If someone else uploaded your software, then NPM is probably protected by the Safe Harbor provision of the DMCA, provided they comply with takedown requests.

steveklabnik 11y ago

The author of that PR is literally npm's laywer, https://kemitchell.com/cv.html https://kemitchell.com/cv.html > The University of Texas School of Law, Juris Doctor with Honors > State Bar of California, Attorney Member

spdustin 11y ago
I stand corrected. I also submitted a PR that, since he's an attorney, can be evaluated for legal enforceability. I think it more clearly specifies the rights granted to npm, and is a nearly verbatim quote from the terms of a consulting agreement we've used with some clients in the past where we are hosting materials they create.
- steveklabnik 11y ago
  I agree that skepticism is healthy :) I'm sure they'll appreciate the PR.
- screature2 11y ago
  I like the call out to ("Special License"). However, I think that in defining how npm can use posted code, the existing language is substantially more lenient than the suggested language in your final paragraph. Current text "...That special license allows npm to copy, publish, and analyze Your Content, and to share its analyses with others. npm may run computer code in Your Content to analyze it, but npm's special license alone does not give npm the right to run code for its functionality in npm products or services." (emphasis added) vs suggested text "You hereby grant npm, Inc. a worldwide, non-exclusive, royalty-free, __sublicenseable and transferable license to use, reproduce, distribute, and display Your Content in connection with the services and web sites owned or operated by npm, Inc., its successors and its affiliates." (emphasis added). Your secondary language looks like it further grants npm the right to not only use, but also sell, transfer, and sublicense any code posted to it because the 'in connection with the services and websites...' restriction seems very loose (e.g. why wouldn't selling to support the services be related?). Pretty sure that's not what npm or anyone posting packages to npm wants.

icebraining 11y ago

IANAL, but there's such thing as an implied license. If you upload a package to a service which has the single purpose of redistributing it to others, it's doubtful that you can then argue that you were damaged by such distribution. If someone else uploaded your software, then NPM is probably protected by the Safe Harbor provision of the DMCA, provided they comply with takedown requests.