4 ms·

I think it's utter bullshit that npm took action the way they did. It's well within his rights to pull the project and update the namespace to whatever he wants

I think it's utter bullshit that npm took action the way they did. It's well within his rights to pull the project and update the namespace to whatever he wants. Woe be to those who didn't contribute all these years.

Macha 5y ago
npm is under no obligation to facilitate that. It's well within their rights to use their TOS to refuse service to him in publishing his disruptive package, and simply continue distributing the previous versions under the license terms Marak explicitly licensed them under. You seem to be treating the "THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND" section of the MIT license as a blanket "well it says they can do whatever so it's fine", but not giving the "Administrators at npm reserve the right to delete content hosted on the npm Services that they deem unacceptable" term the same leeway. Either we can expect some sort of implied good faith from both parties despite their legal terms and licenses disavowing such, or we can simply expect the exact text of the licenses. To have one set of expectations on Marak, and another on npm is unreasonable.
- sam0x17 5y ago
  It just really rubs me the wrong way -- who can argue this isn't just a legitimate reboot of faker? Why does npm get to say that the future of faker isn't a directory with a single .md file? What's to stop this from happening with something higher profile, like npm just decides the new version of webpack is trash, and locks out the maintainers. Sounds like some sussy sourceforge shit to me. It's one thing if there is a virus or a cryptominer in the repo, or if the package maintainer gets hacked and needs control restored. It's another thing to exert editorial control over a popular package and lock out the maintainer. Bad look. Would rather live in the universe where people just re-upload the original under a different maintainer or (gasp) actually pay the guy for all the work he's done over the years, than the world in which certain npm packages become "too big to fail" so we never get to see the actual dynamics of failure, that are supposed to happen, come into play.
- sam0x17 5y ago
  Is it really open and free if NPM can make editorial decisions that trump the repo owner, whenever they want? I think the implication of this is software packaged on NPM isn't really open source.
  - Macha 5y ago
    Freedom 3 of the Free Software Definition: > The freedom to distribute copies of your modified versions to others (freedom 3). By doing this you can give the whole community a chance to benefit from your changes. Access to the source code is a precondition for this. One of the tests for the Debian Free Software Guidelines: > "The Tentacles of Evil test". Imagine that the author is hired by a large evil corporation and, now in their thrall, attempts to do the worst to the users of the program: to make their lives miserable, to make them stop using the program, to expose them to legal liability, to make the program non-free, to discover their secrets, etc. The same can happen to a corporation bought out by a larger corporation bent on destroying free software in order to maintain its monopoly and extend its evil empire. To be free, the license cannot allow even the author to take away the required freedoms. By these standards, if NPM could not do this (or could only do this by virtue of their TOS), then faker.js and colors.js would not qualify as free software. Most free software definitions are focused on preserving the freedoms of the user first, other wishes of the author like "being paid" or "printing ascii American flags" are secondary
3np 5y ago
Maybe the issue isn't that NPM and GitHub are taking that decision, but the risk of network-effected monopolies. Same discussion as with generic social media and FB/Meta. A more distributed network benefits everyone. So if this rubs you the wrong way, why not take the opportunity to consider defaulting to alternatives (even just a smaller player), or even self-hosting?

Macha 5y ago

npm is under no obligation to facilitate that. It's well within their rights to use their TOS to refuse service to him in publishing his disruptive package, and simply continue distributing the previous versions under the license terms Marak explicitly licensed them under. You seem to be treating the "THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND" section of the MIT license as a blanket "well it says they can do whatever so it's fine", but not giving the "Administrators at npm reserve the right to delete content hosted on the npm Services that they deem unacceptable" term the same leeway. Either we can expect some sort of implied good faith from both parties despite their legal terms and licenses disavowing such, or we can simply expect the exact text of the licenses. To have one set of expectations on Marak, and another on npm is unreasonable.

sam0x17 5y ago
It just really rubs me the wrong way -- who can argue this isn't just a legitimate reboot of faker? Why does npm get to say that the future of faker isn't a directory with a single .md file? What's to stop this from happening with something higher profile, like npm just decides the new version of webpack is trash, and locks out the maintainers. Sounds like some sussy sourceforge shit to me. It's one thing if there is a virus or a cryptominer in the repo, or if the package maintainer gets hacked and needs control restored. It's another thing to exert editorial control over a popular package and lock out the maintainer. Bad look. Would rather live in the universe where people just re-upload the original under a different maintainer or (gasp) actually pay the guy for all the work he's done over the years, than the world in which certain npm packages become "too big to fail" so we never get to see the actual dynamics of failure, that are supposed to happen, come into play.
sam0x17 5y ago
Is it really open and free if NPM can make editorial decisions that trump the repo owner, whenever they want? I think the implication of this is software packaged on NPM isn't really open source.
- Macha 5y ago
  Freedom 3 of the Free Software Definition: > The freedom to distribute copies of your modified versions to others (freedom 3). By doing this you can give the whole community a chance to benefit from your changes. Access to the source code is a precondition for this. One of the tests for the Debian Free Software Guidelines: > "The Tentacles of Evil test". Imagine that the author is hired by a large evil corporation and, now in their thrall, attempts to do the worst to the users of the program: to make their lives miserable, to make them stop using the program, to expose them to legal liability, to make the program non-free, to discover their secrets, etc. The same can happen to a corporation bought out by a larger corporation bent on destroying free software in order to maintain its monopoly and extend its evil empire. To be free, the license cannot allow even the author to take away the required freedoms. By these standards, if NPM could not do this (or could only do this by virtue of their TOS), then faker.js and colors.js would not qualify as free software. Most free software definitions are focused on preserving the freedoms of the user first, other wishes of the author like "being paid" or "printing ascii American flags" are secondary

3np 5y ago

Maybe the issue isn't that NPM and GitHub are taking that decision, but the risk of network-effected monopolies. Same discussion as with generic social media and FB/Meta. A more distributed network benefits everyone. So if this rubs you the wrong way, why not take the opportunity to consider defaulting to alternatives (even just a smaller player), or even self-hosting?