4 ms·

> If NPM would have prevented the depublishing, he would have made a scene and in the worst case, they would have looked bad. I mean he says he asked them to r

by lmm 1y ago

> If NPM would have prevented the depublishing, he would have made a scene and in the worst case, they would have looked bad. I mean he says he asked them to remove all his packages, expecting them to do so gradually, following whatever mitigation strategy they felt appropriate (e.g. some kind of warning and fadeout process), and instead they gave him a script to do it immediately so he did that.

nindalf 1y ago
[flagged]
- IggleSniggle 1y ago
  Please. It looks like he was doing dev as a hobby, asked a big company how to handle removing his packages, and did what they told him to. They might not have had the right policy, but that doesn't make a guy who doesn't want to give his packages away to a company just because they're making threats into an asshole. It makes him typical.
  - nindalf 1y ago
    He had already given everyone a license to use his software. That’s what FOSS software is - the users are granted a license to use the software and it can’t be revoked, even if the author is throwing a tantrum.
    - IggleSniggle 1y ago
      Sure, but that license doesn't include the requirement to host in perpetuity, and anyway, I wouldn't expect a hobbyist to need to worry about this. If I decide to make my gamer-profile private / offline or something and that breaks your crawler, even though I previously granted unrestricted public access to that data, that's really not my problem.
      - nindalf 1y ago
        Let’s not pretend he was hosting the software. Npm was. No software developer or organisation will use a software repository that allows deletion of packages. That’s why it’s not a thing anymore. If you think this “right” should exist, that’s a market niche for you to exploit. But you won’t, will you? Because like I said, no user wants this.
        IggleSniggle 1y ago
        ??? I didn't say anybody using npm wants this. I'm saying npm had the wrong policy around deletion, that npm could have handled the situation differently, and also that Azer not knowing or caring about the effects of removing the package doesn't make him an asshole or even negligent (although it also doesn't mean he ISNT an asshole; that's a separate matter). The point is that Azer didn't owe anybody anything; not even to know what he was doing. npm did. That said, I'm glad the wake-up call came in such a relatively benign way.
- lmm 1y ago
  > That’s precisely why unpublishing an entire package/crate/gem is not a supported operation on any mainstream repository. Every competent repository has a process for unpublishing. Sooner or later someone will upload something that someone else claims the copyright to, and then either you take it down when you get a DMCA notice or you lose your safe harbour. Maybe you replace it with some sort of tombstone. Maybe you warn all the reverse dependencies first. But you have to have a way to remove content.

by lmm 1y ago

nindalf 1y ago

[flagged]

IggleSniggle 1y ago
Please. It looks like he was doing dev as a hobby, asked a big company how to handle removing his packages, and did what they told him to. They might not have had the right policy, but that doesn't make a guy who doesn't want to give his packages away to a company just because they're making threats into an asshole. It makes him typical.
- nindalf 1y ago
  He had already given everyone a license to use his software. That’s what FOSS software is - the users are granted a license to use the software and it can’t be revoked, even if the author is throwing a tantrum.
  - IggleSniggle 1y ago
    Sure, but that license doesn't include the requirement to host in perpetuity, and anyway, I wouldn't expect a hobbyist to need to worry about this. If I decide to make my gamer-profile private / offline or something and that breaks your crawler, even though I previously granted unrestricted public access to that data, that's really not my problem.
    - nindalf 1y ago
      Let’s not pretend he was hosting the software. Npm was. No software developer or organisation will use a software repository that allows deletion of packages. That’s why it’s not a thing anymore. If you think this “right” should exist, that’s a market niche for you to exploit. But you won’t, will you? Because like I said, no user wants this.
      - IggleSniggle 1y ago
        ??? I didn't say anybody using npm wants this. I'm saying npm had the wrong policy around deletion, that npm could have handled the situation differently, and also that Azer not knowing or caring about the effects of removing the package doesn't make him an asshole or even negligent (although it also doesn't mean he ISNT an asshole; that's a separate matter). The point is that Azer didn't owe anybody anything; not even to know what he was doing. npm did. That said, I'm glad the wake-up call came in such a relatively benign way.
lmm 1y ago
> That’s precisely why unpublishing an entire package/crate/gem is not a supported operation on any mainstream repository. Every competent repository has a process for unpublishing. Sooner or later someone will upload something that someone else claims the copyright to, and then either you take it down when you get a DMCA notice or you lose your safe harbour. Maybe you replace it with some sort of tombstone. Maybe you warn all the reverse dependencies first. But you have to have a way to remove content.