6 ms·

Seriously, I don't get how the others in this thread don't get this. Nobody's talking about the legalese of the license - he's undermined his _own_ credibility,

Seriously, I don't get how the others in this thread don't get this. Nobody's talking about the legalese of the license - he's undermined his _own_ credibility, which is all that really matters in open source. If he's fine with people not trusting his packages in the future, that's fine, but THAT's the trade-off, regardless of how you license the code.

timkpaine 8y ago
you forget how seriously lazy developers are, remember left-pad?
gregknicholson 8y ago
He's been too naive and creduluous in judging a person based on limited information. His coding skills aren't in question — the software was fine while he was still in charge of it. I suspect Dominic didn't see himself as the maintainer of the package, but as a maintainer of a copy of the package (like how git is designed to work). With this perspective, of course someone else can be a maintainer. The problem is that NPM changed their upstream from Dominic to right9ctrl without checking. (Maybe because Dominic clicked a button — NPM is still responsible for accepting that decision or not.)
- tjholowaychuk 8y ago
  Not to blame them NPM, they're great people, but I often get requests from random people going through NPM support to use an existing name (saying they will bump major). The centralized naming scheme is to blame here, it normalizes these "cute" names and users have demanded these since day one. They could/should have probably been scoped from the beginning, or people should just stop trying to capture fancy names. I get tired of receiving emails about those kinds of things personally, you try to just ignore them, sometimes their request sounds reasonable but still, can those people be trusted, who knows.
  - gregknicholson 8y ago
    > The centralized naming scheme is to blame here It would have been better just to use URLs, so if you see "npm install https://github.com/dominictarr/event-stream" https://github.com/dominictarr/event-stream" then it's clear you're trusting "github.com". (Yes, DNS is centralised. That can be fixed independently.)
  - preommr 8y ago
    > NPM support to use an existing name (saying they will bump major). Sorry, could you please explain what this means? I keep seeing comments about bumping version numbers (e.g. the right9ctrl did some shenanigans with versioning).
    - tjholowaychuk 8y ago
      Ah sometimes you get people asking to use a name such as my "log" pkg in npm, but bumping from 2.0 to 3.0 so that dependencies aren't messed up. Assuming the person has no bad intentions I think it's a perfectly reasonable request. I ignored this particular request via email a few times, because I just really don't want to spend time dealing with Node stuff. You then get a request from NPM support asking the same thing, so I agreed to it, that's all it takes to get access to a package really. I think from now on I'm just going to tell people to come up with a different name, this wouldn't be a problem if the names were scoped by default.
jodrellblank 8y ago
he's undermined his _own_ credibility, which is all that really matters in open source. Even if I take your sentence dead seriously - the code injection, the crypto wallet stealing, the disruption to the downlevel users, none of that matters only Dominic's credibility matters - where does that get me? Assume that Dominic was bribed to inject the code himself, with a share of the profits, and he did, maliciously and criminally, and he gets arrested, and people were still disrupted and money was stolen and insecurities were introduced and flamewars were had .. and his reputation is now justly and fairly tarnished for all time.. what good does that do anyone? How does that avoid it happening in future or change how we respond to it?

timkpaine 8y ago

you forget how seriously lazy developers are, remember left-pad?

gregknicholson 8y ago

He's been too naive and creduluous in judging a person based on limited information. His coding skills aren't in question — the software was fine while he was still in charge of it. I suspect Dominic didn't see himself as the maintainer of the package, but as a maintainer of a copy of the package (like how git is designed to work). With this perspective, of course someone else can be a maintainer. The problem is that NPM changed their upstream from Dominic to right9ctrl without checking. (Maybe because Dominic clicked a button — NPM is still responsible for accepting that decision or not.)

tjholowaychuk 8y ago
Not to blame them NPM, they're great people, but I often get requests from random people going through NPM support to use an existing name (saying they will bump major). The centralized naming scheme is to blame here, it normalizes these "cute" names and users have demanded these since day one. They could/should have probably been scoped from the beginning, or people should just stop trying to capture fancy names. I get tired of receiving emails about those kinds of things personally, you try to just ignore them, sometimes their request sounds reasonable but still, can those people be trusted, who knows.
- gregknicholson 8y ago
  > The centralized naming scheme is to blame here It would have been better just to use URLs, so if you see "npm install https://github.com/dominictarr/event-stream" https://github.com/dominictarr/event-stream" then it's clear you're trusting "github.com". (Yes, DNS is centralised. That can be fixed independently.)
- preommr 8y ago
  > NPM support to use an existing name (saying they will bump major). Sorry, could you please explain what this means? I keep seeing comments about bumping version numbers (e.g. the right9ctrl did some shenanigans with versioning).
  - tjholowaychuk 8y ago
    Ah sometimes you get people asking to use a name such as my "log" pkg in npm, but bumping from 2.0 to 3.0 so that dependencies aren't messed up. Assuming the person has no bad intentions I think it's a perfectly reasonable request. I ignored this particular request via email a few times, because I just really don't want to spend time dealing with Node stuff. You then get a request from NPM support asking the same thing, so I agreed to it, that's all it takes to get access to a package really. I think from now on I'm just going to tell people to come up with a different name, this wouldn't be a problem if the names were scoped by default.

jodrellblank 8y ago

he's undermined his _own_ credibility, which is all that really matters in open source. Even if I take your sentence dead seriously - the code injection, the crypto wallet stealing, the disruption to the downlevel users, none of that matters only Dominic's credibility matters - where does that get me? Assume that Dominic was bribed to inject the code himself, with a share of the profits, and he did, maliciously and criminally, and he gets arrested, and people were still disrupted and money was stolen and insecurities were introduced and flamewars were had .. and his reputation is now justly and fairly tarnished for all time.. what good does that do anyone? How does that avoid it happening in future or change how we respond to it?