3 ms·

The legit trademark issue is https://npmjs.com/package/cypress-cloud https://npmjs.com/package/cypress-cloud (package owned by the Sorry Cypress dude) and then

The legit trademark issue is https://npmjs.com/package/cypress-cloud https://npmjs.com/package/cypress-cloud (package owned by the Sorry Cypress dude) and then the OP article above links to a bunch of packages that seem to be from disparate owners, but are actually all the same guy OR come from code originally written by that guy and _THEN_ forked (Deploy Sentinel). The dude also has some pretty nice namesquatted packages (cypress-vscode, cypress-debug) that he references in that article. It made me think that there was serious anti-competitive energy in there and that made me worry for the community. I rolled back the tweet because it was getting too much traction... and I lost trust in the article once it seemed to be a personal thing that Cy was responding to with radio silence and legalese. Once I realized the article was misleading, I deleted the tweets that drove the traffic to HN today.

agoldis 3y ago
Thanks for sharing your concerns, Jessica, we tried to be fully transparent and share our findings with the interested audience. I have added a disclaimer that explicitly mentions the owners of the packages to avoid confusion. - The article clearly states what entities are affected - Currents, Sorry Cypress and Deploy Sentinel; it doesn't claim those are random package authors. - Not all the listed packages are written by the dude or written and _THEN_ forked, we provided a detailed breakdown of each package origin. For example, @deploysentinel/cypress-debugger is a completely standalone, innovative software released more than a year before Cypress Test Replay and cypress-debugger - The article lists all the blocked packages we were able to discover. We published the full list to be totally transparent. Obviously, we create and work on cypress-related packages - e.g. a vscode extension for cypress. There was also a rename from Cypress Dashboard to Cypress Cloud. NPM lists ~1.6K packages with "cypress-" prefix. Another example: we ran a survey on a community Slack channel with ~500 members to pick a name for cypress-debugger - the options were: cypress-debugger, cypress-debug, cypress-tracer; cypress-debugger won. An interesting experiment would be to rename those packages. Do you believe they will be unblocked?

agoldis 3y ago

Thanks for sharing your concerns, Jessica, we tried to be fully transparent and share our findings with the interested audience. I have added a disclaimer that explicitly mentions the owners of the packages to avoid confusion. - The article clearly states what entities are affected - Currents, Sorry Cypress and Deploy Sentinel; it doesn't claim those are random package authors. - Not all the listed packages are written by the dude or written and _THEN_ forked, we provided a detailed breakdown of each package origin. For example, @deploysentinel/cypress-debugger is a completely standalone, innovative software released more than a year before Cypress Test Replay and cypress-debugger - The article lists all the blocked packages we were able to discover. We published the full list to be totally transparent. Obviously, we create and work on cypress-related packages - e.g. a vscode extension for cypress. There was also a rename from Cypress Dashboard to Cypress Cloud. NPM lists ~1.6K packages with "cypress-" prefix. Another example: we ran a survey on a community Slack channel with ~500 members to pick a name for cypress-debugger - the options were: cypress-debugger, cypress-debug, cypress-tracer; cypress-debugger won. An interesting experiment would be to rename those packages. Do you believe they will be unblocked?