5 ms·

Unlike domain names where people actually pay for them, I think package repositories like npm should punish squatting like GitHub. For example I contacted GitH

Unlike domain names where people actually pay for them, I think package repositories like npm should punish squatting like GitHub. For example I contacted GitHub because I wanted an organization name for a company I'm registering in 2017. Their support looked at the organization, which had zero public or private repositories, told me they went beyond a time period of zero activity in which their name could be reclaimed by someone else and I got it (and no they didn't tell me the time period, it was just a vague statement regarding it). NPM should look at these and if they've been empty for X amount of time, remove them. Now the problem is controlling new squatters so they may need to offer a more complex solution when a name returns to the pool but I think it needs to be done (I know names don't typically return to be re-used in NPM but if they're removing them for squatting I think they should).

subway 10y ago
Even better, packages should be namespaced to the parties maintaining them
- tlrobinson 10y ago
  That's just shuffling the problem around, people will squat on user accounts.
  - rwallace 10y ago
    Empirically, it doesn't just shuffle the problem around, it dramatically reduces it. On Google Code, every time you tried to create a project, the name would always be taken. On Github, every time you try to create a project, you can go ahead and use the name, and I haven't heard of anyone having trouble finding something acceptable to use for their account name.
- chrisfosterelli 10y ago
  This has been supported for a long while now but it never really caught on much. It's still an option if your favourite name is taken, though.
  - minitech 10y ago
    Is this the @a/b namespacing that requires paying monthly for names (that are longer)? That’s not going to fly for most people.
    - deleted 10y ago
      [deleted]
    - chrisfosterelli 10y ago
      Scoped packages are free: https://docs.npmjs.com/getting-started/scoped-packages https://docs.npmjs.com/getting-started/scoped-packages In regards to length, well, that's how namespacing works. Although that is likely part of what has contributed to it receiving less traction.
      - minitech 10y ago
        Oh, I thought you needed to register an organization to use scoped packages. Thanks! (And yes, I don't mind the length... unless I'm paying for it.)
chrisfosterelli 10y ago
Good news! npm's dispute policy actually explicitly covers this behaviour. If someone wanted any of these packages, npm would likely be happy to give it to them. You can also report them to have the packages removed by emailing them at support@npmjs.com Source: https://www.npmjs.com/policies/disputes https://www.npmjs.com/policies/disputes
- lhnz 10y ago
  I didn't know about this. Perhaps it should be better publicised?
  - franciscop 10y ago
    It's right in the footer with a clear name in all NPM's pages... it took me no time when I was looking for it back in the day to find the policy, maybe the problem is you never needed it?
    - lhnz 10y ago
      You're referring to a link buried within 'Legal Stuff' at the bottom of the page, away from all other actionable sections linked to a package. I don't think that's even close to being a satisfactory call-to-action. Whenever I've picked a name for a project, I've always generated them by combining words together with hyphens. If I realised that I could take over package names that were being squatted, there are many times I would have done so.
      - franciscop 10y ago
        Yes? I mean the one clearly labeled "Package Name Disputes"... it's not like this page needs a big CTA, it's something you'd reasonably expect to find within a "Policy" or "Terms of Service" page but instead it has a link on every footer. And actually... "Package name disputes" are mentioned in different ways within 5 of the 6 links in the "Legal stuff" section, so I am pretty sure that it's just for lack of reading/searching, not because they are actively trying to hide it.
nodesocket 10y ago
I also was able to do this for my startup https://github.com/commando https://github.com/commando from GitHub. @commando was being squatted, but after they researched and I proved I was the owner, they transferred the organization name to me. +1 for GitHub.
seldo 10y ago
A few points: as @chrisfosterelli noted, if a package is being squatted we'll give it to you, no problem. As for why we don't automatically/proactively handle squatting: it's a very thorny problem. Whatever minimum standard we applied to count as "not squatting" could be trivially discovered and gamed, eventually resulting in people who wanted to squat on a name just publishing a copy of `express` or something to that name as a placeholder. Relatedly: you can report offensive, or deliberately confusing package names ("typosquatting") and we will take those package names down permanently.

subway 10y ago

Even better, packages should be namespaced to the parties maintaining them

tlrobinson 10y ago
That's just shuffling the problem around, people will squat on user accounts.
- rwallace 10y ago
  Empirically, it doesn't just shuffle the problem around, it dramatically reduces it. On Google Code, every time you tried to create a project, the name would always be taken. On Github, every time you try to create a project, you can go ahead and use the name, and I haven't heard of anyone having trouble finding something acceptable to use for their account name.
chrisfosterelli 10y ago
This has been supported for a long while now but it never really caught on much. It's still an option if your favourite name is taken, though.
- minitech 10y ago
  Is this the @a/b namespacing that requires paying monthly for names (that are longer)? That’s not going to fly for most people.
  - deleted 10y ago
    [deleted]
  - chrisfosterelli 10y ago
    Scoped packages are free: https://docs.npmjs.com/getting-started/scoped-packages https://docs.npmjs.com/getting-started/scoped-packages In regards to length, well, that's how namespacing works. Although that is likely part of what has contributed to it receiving less traction.
    - minitech 10y ago
      Oh, I thought you needed to register an organization to use scoped packages. Thanks! (And yes, I don't mind the length... unless I'm paying for it.)

chrisfosterelli 10y ago

Good news! npm's dispute policy actually explicitly covers this behaviour. If someone wanted any of these packages, npm would likely be happy to give it to them. You can also report them to have the packages removed by emailing them at support@npmjs.com Source: https://www.npmjs.com/policies/disputes https://www.npmjs.com/policies/disputes

lhnz 10y ago
I didn't know about this. Perhaps it should be better publicised?
- franciscop 10y ago
  It's right in the footer with a clear name in all NPM's pages... it took me no time when I was looking for it back in the day to find the policy, maybe the problem is you never needed it?
  - lhnz 10y ago
    You're referring to a link buried within 'Legal Stuff' at the bottom of the page, away from all other actionable sections linked to a package. I don't think that's even close to being a satisfactory call-to-action. Whenever I've picked a name for a project, I've always generated them by combining words together with hyphens. If I realised that I could take over package names that were being squatted, there are many times I would have done so.
    - franciscop 10y ago
      Yes? I mean the one clearly labeled "Package Name Disputes"... it's not like this page needs a big CTA, it's something you'd reasonably expect to find within a "Policy" or "Terms of Service" page but instead it has a link on every footer. And actually... "Package name disputes" are mentioned in different ways within 5 of the 6 links in the "Legal stuff" section, so I am pretty sure that it's just for lack of reading/searching, not because they are actively trying to hide it.

nodesocket 10y ago

I also was able to do this for my startup https://github.com/commando https://github.com/commando from GitHub. @commando was being squatted, but after they researched and I proved I was the owner, they transferred the organization name to me. +1 for GitHub.

seldo 10y ago

A few points: as @chrisfosterelli noted, if a package is being squatted we'll give it to you, no problem. As for why we don't automatically/proactively handle squatting: it's a very thorny problem. Whatever minimum standard we applied to count as "not squatting" could be trivially discovered and gamed, eventually resulting in people who wanted to squat on a name just publishing a copy of `express` or something to that name as a placeholder. Relatedly: you can report offensive, or deliberately confusing package names ("typosquatting") and we will take those package names down permanently.