3 ms·

This seems like a reasonable approach. It does bracket some of the larger issues that the left-pad debacle foregrounded (dispute resolution and the potential of

by pfooti 11y ago

This seems like a reasonable approach. It does bracket some of the larger issues that the left-pad debacle foregrounded (dispute resolution and the potential of malicious devs to release dangerous code), but it is a good step forward. Restricting unpublish will prevent some major catastrophes in the future. The issue of a malicious user publishing an incremented version with bad code still stands (as a patch semver release on a package that's not 0.X), but that's not particular to npm. It's just part of the trust ecosystem. The issue of conflict resolution is a thornier one. The medium post by the people at kik [0] paints Azer in a slightly less flattering light. His actions aren't precisely sympathetic, especially since the people at kik and npm both attempted to amicably resolve the problem (and Kik has a legit beef here). Conflict resolution is hard to programmatically / procedurally resolve, and in the case of a limited namespace (more people should use scopes, I guess) there's a real issue when you're releasing a package with the same name as something with registered trademarks in the same domain. Argue with trademark law if you want, and the use-it-or-lose-it features it has, but don't get mad at npm and Isaacs for following the lawyer's lead, especially with Azer's general attitude throughout the exchange. 0: https://medium.com/@mproberts/a-discussion-about-the-breaking-of-the-internet-3d4d2a83aa4d https://medium.com/@mproberts/a-discussion-about-the-breakin...

catnaroek 11y ago
> attempted to amicably resolve the problem I'm not sure I'd use the term “amicably” to describe kik's emails. Was it really necessary to use the phrase “banging on your door”? It's perfectly possible to threaten legal action (it's their right) without, in their own words, “being a dick” about it. They could've phrased it like this: “We'd like to settle this dispute amicably, rather than pursue legal action, but we will defend our trademark.” Or something like that. Dunno, IANAL. While Azer's knee-jerk reaction didn't help matters, I can't bring myself to blame him, because I know I would've reacted the same way, if not worse.
- pfooti 11y ago
  Yah, the problem is (IMO at least) inherent in trademark law. If Azer actually created an OSS package (or publicized kik broadly), the lawyers would be pretty much compelled to start banging on his door. If they failed to do so, Kik the corporation would lose their rights to that trademark. So yeah, I agree - the phrasing wasn't super great. But it wasn't actually a threat in itself, just a statement about lawyers being compelled to do what they have to do. An actual threat - hitting with a C&D letter before reaching out - would have been much more aggressive.
  - catnaroek 11y ago
    > But it wasn't actually a threat in itself It's a threat no matter how you slice it. You could get arrested if you bang on your neighbor's door without a good reason.

by pfooti 11y ago

catnaroek 11y ago

> attempted to amicably resolve the problem I'm not sure I'd use the term “amicably” to describe kik's emails. Was it really necessary to use the phrase “banging on your door”? It's perfectly possible to threaten legal action (it's their right) without, in their own words, “being a dick” about it. They could've phrased it like this: “We'd like to settle this dispute amicably, rather than pursue legal action, but we will defend our trademark.” Or something like that. Dunno, IANAL. While Azer's knee-jerk reaction didn't help matters, I can't bring myself to blame him, because I know I would've reacted the same way, if not worse.

pfooti 11y ago
Yah, the problem is (IMO at least) inherent in trademark law. If Azer actually created an OSS package (or publicized kik broadly), the lawyers would be pretty much compelled to start banging on his door. If they failed to do so, Kik the corporation would lose their rights to that trademark. So yeah, I agree - the phrasing wasn't super great. But it wasn't actually a threat in itself, just a statement about lawyers being compelled to do what they have to do. An actual threat - hitting with a C&D letter before reaching out - would have been much more aggressive.
- catnaroek 11y ago
  > But it wasn't actually a threat in itself It's a threat no matter how you slice it. You could get arrested if you bang on your neighbor's door without a good reason.