4 ms·

This concern is indeed not addressed in the text I cited. However, though my English reading comprehension isn't precisely the best either, I'm pretty sure this

This concern is indeed not addressed in the text I cited. However, though my English reading comprehension isn't precisely the best either, I'm pretty sure this concern wasn't brought up in your comment that I was replying to when citing that text. I don't see this concern addressed in their Package Name Disputes document at all: https://www.npmjs.com/policies/disputes https://www.npmjs.com/policies/disputes Perhaps they'd be delighted if you brought it up in the public forum they linked to at the end of the blogpost? https://github.com/npm/policies/issues/44 https://github.com/npm/policies/issues/44

catnaroek 11y ago
> Perhaps they'd be delighted if you brought it up Or perhaps they would not. After all, my question is a very natural question to ask, and they don't seem to have given it any thought, as if they were ignoring a particularly big elephant in a small and cramped room. It seems deliberate to me. And, even under the unlikely assumption that it isn't deliberate, it says a lot about npm Inc's lack of empathy for their own users. In any case, not being a JavaScript programmer myself, let alone an npm user, I can't bring myself to care enough to comment on their GitHub issue.
- laughinghan 11y ago
  Honestly I don't think it's as natural a question as you think it is (I haven't noticed anyone else bring it up on HN or in that GitHub Issue), and I don't think it's hard to answer, either. To make clear a package you published is your intellectual property, you're expected to use the "author" field in package.json; it's also common to mention your name in the README. The versions you published would continue to name you in the "authors" field and in the README, rather than someone else. Perhaps NPM thinks that suffices. (You might do neither of those things, and the someone else might use your name to publish later versions of the package, or a random person might use your name to publish a completely different package. But these problems not affected by the policies being discussed, nor really have anything to do with NPM seeing as the same thing could happen on GitHub (someone else can publish a repo and attribute you as the author; also, will GitHub make perfectly clear that a repo you publish is your intellectual property, rather than someone else's?).)
  - catnaroek 11y ago
    > will GitHub make perfectly clear that a repo you publish is your intellectual property, rather than someone else's? My question doesn't apply to GitHub, because GitHub doesn't transfer your repositories to other people unless you tell it to.
    - laughinghan 11y ago
      My comparison with GitHub was only referring to the problems of people not attributing themselves in their own repos/packages, later owners of a repo/package misattributing later work to earlier owners of the repo/package, and random repos/packages you have nothing to do with claiming you're their author.
  - sangnoir 11y ago
    > Honestly I don't think it's as natural a question as you think it is (I haven't noticed anyone else bring it up on HN or in that GitHub Issue) It is a natural question, and I have asked it elsewhere in this thread (https://news.ycombinator.com/item?id=11385689 https://news.ycombinator.com/item?id=11385689). When control of package is handed over to a corp at version >=5.0.0, who exactly is responsible for releasing the bug-fix version 1.8.5? Point-releases are done all the time to fix security/bugs, so either NPM Inc didn't think about that scenario (bad) or decided not to address it (very bad).

catnaroek 11y ago

> Perhaps they'd be delighted if you brought it up Or perhaps they would not. After all, my question is a very natural question to ask, and they don't seem to have given it any thought, as if they were ignoring a particularly big elephant in a small and cramped room. It seems deliberate to me. And, even under the unlikely assumption that it isn't deliberate, it says a lot about npm Inc's lack of empathy for their own users. In any case, not being a JavaScript programmer myself, let alone an npm user, I can't bring myself to care enough to comment on their GitHub issue.

laughinghan 11y ago
Honestly I don't think it's as natural a question as you think it is (I haven't noticed anyone else bring it up on HN or in that GitHub Issue), and I don't think it's hard to answer, either. To make clear a package you published is your intellectual property, you're expected to use the "author" field in package.json; it's also common to mention your name in the README. The versions you published would continue to name you in the "authors" field and in the README, rather than someone else. Perhaps NPM thinks that suffices. (You might do neither of those things, and the someone else might use your name to publish later versions of the package, or a random person might use your name to publish a completely different package. But these problems not affected by the policies being discussed, nor really have anything to do with NPM seeing as the same thing could happen on GitHub (someone else can publish a repo and attribute you as the author; also, will GitHub make perfectly clear that a repo you publish is your intellectual property, rather than someone else's?).)
- catnaroek 11y ago
  > will GitHub make perfectly clear that a repo you publish is your intellectual property, rather than someone else's? My question doesn't apply to GitHub, because GitHub doesn't transfer your repositories to other people unless you tell it to.
  - laughinghan 11y ago
    My comparison with GitHub was only referring to the problems of people not attributing themselves in their own repos/packages, later owners of a repo/package misattributing later work to earlier owners of the repo/package, and random repos/packages you have nothing to do with claiming you're their author.
- sangnoir 11y ago
  > Honestly I don't think it's as natural a question as you think it is (I haven't noticed anyone else bring it up on HN or in that GitHub Issue) It is a natural question, and I have asked it elsewhere in this thread (https://news.ycombinator.com/item?id=11385689 https://news.ycombinator.com/item?id=11385689). When control of package is handed over to a corp at version >=5.0.0, who exactly is responsible for releasing the bug-fix version 1.8.5? Point-releases are done all the time to fix security/bugs, so either NPM Inc didn't think about that scenario (bad) or decided not to address it (very bad).