undefined | Better HN

story

0 pointsallover8y ago0 comments

> and their behaviour up until now slightly suggests the opposite.

Please elaborate. Afaik 'kik' wasn't significantly depended upon, and people using the old kik could still install it [1] (had the leftpad author not unpublished it), and that is the only example I'm aware of of npm handing over a package name.

[1] http://blog.npmjs.org/post/141577284765/kik-left-pad-and-npm

0 comments

mcny8y ago

I cannot believe anyone will defend npm over it.

There is no scenario where it is OK to hand over a namespace to someone else. At worst, it is acceptable to make a namespace unavailable to anyone.

I think npm is completely unable to exist as an organization and should disband immediately.

Kliment8y ago

Trouble is, if they do that, someone else will quickly replace them, take over the same function, and users will likely not notice that they are now trusting a different unverifiable entity to ensure package integrity

mcny8y ago

Users will continue to trust what comes packages with node. Nothing needs to change from a user's perspective. They will still type npm ... But it will point to a new infrastructure (and more importantly led by nobody currently leading npm).

If node wants to do this, I think they totally can. There just needs to be the will to cut off and blacklist the current npm team.

macintux8y ago

How many times does it have to happen to warrant concern?

Trust, once broken, isn't quickly restored.

chickenfries8y ago

Hypothetically, even if it's just the author of kik (I don't know if it is), isn't that still unfair to them? They might have used it on client projects. Why would I want to use your registry if you're going to break all of my software because a corporation wants a my package name?

bigiain8y ago

Pretty sure "allover" isn't "significantly depended upon" - how would you feel if YC gave that account here to me just because I went and paid for a trademark on it?

alloverOP8y ago

I have no investment in this username, so I wouldn't care.

And "significantly depended upon" doesn't make sense in your example, but is relevant in terms of a package in a registry.

j / k navigate · click thread line to collapse

0 comments

mcny8y ago

I cannot believe anyone will defend npm over it.

There is no scenario where it is OK to hand over a namespace to someone else. At worst, it is acceptable to make a namespace unavailable to anyone.

I think npm is completely unable to exist as an organization and should disband immediately.

Kliment8y ago

mcny8y ago

If node wants to do this, I think they totally can. There just needs to be the will to cut off and blacklist the current npm team.

macintux8y ago

How many times does it have to happen to warrant concern?

Trust, once broken, isn't quickly restored.

chickenfries8y ago

bigiain8y ago

Pretty sure "allover" isn't "significantly depended upon" - how would you feel if YC gave that account here to me just because I went and paid for a trademark on it?

alloverOP8y ago

I have no investment in this username, so I wouldn't care.

And "significantly depended upon" doesn't make sense in your example, but is relevant in terms of a package in a registry.

j / k navigate · click thread line to collapse