skysight-inc/HackerNews huggingface dataset:
I think it's amusing to see this from the perspective of the company. Some guy uses your trademark without your permission so you tell him to knock it off. He refuses, so you go around him, and so he protests... by fucking over all of his users. In a dispute that doesn't involve them. And people are celebrating this.
Url changed from http://www.pcworld.com/article/3046849/security/tor-project-..., which points to this.
> At what point does JaaS stop scaling? Perhaps this one stop on the way to fully digitized contracts?

Think about the difference between an "AI" capable of checking flight data and identifying delays greater than (X) minutes vs. "true" fully-digitized contracts (i.e., an AI that can reliably determine whether Party Y did indeed use its "reasonable best efforts" to market Product Z).

Those two things are actually more distant from each other than an "AI" capable of playing Rock-Paper-Scissors vs. an AI that can pass the Turing test.
Mocking in Python – How to Bypass Expensive and External Code Within Your Tests
British Airways Flight 5390
I think the grandparent post pretty clearly demonstrated a pretty good definition:

> Global is asserting questionable IP rights aggressively and counting on the high cost of defensive litigation to win, so we consider it a troll

If they are deliberately using shady claims (e.g. clearly overly broad interpretations of their patent) and counting on the high cost of litigation to get their desired outcome, I don't see what it matters whether they are a practicing or non practicing entity.
OSCON moves to Austin
I've spoken to people who were convicted of a crime, spent some time in prison, and were then transferred to a medium secure forensic unit for treatment for their severe mental illness.

Every single one of them said they preferred the prison to the hospital.

This is because prisoners have sentences that they serve, but patients don't - they're just treated until they're well enough to go back to the prison population.

In general "I have a severe mental illness" is not enough to help a defendant get off. The test is something like "I have a severe mental illness, and it was controlling me during my time, and I did not know what I was doing". If we just look at the population of people with a mental illness we see that most of them don't meet this strict requirement.

Of course, this in England. I guess things are different in the US.
Like, a sailing ship?
At some point the length was arbitrary. As precedence is created, it becomes more deterministic but only somewhat more so. Often times there are minimum sentencing laws, the length of which is mostly arbitrary.
I don't think it's relevant - if there are other libraries depending on it, the code probably needs to stay. Maybe there's a bug but it's been worked around. The library has been up long enough for others to depend on it and publish their own code using it.

You could have a "soft" unpublish so the module is still available for any libraries that depend on that specific version but it won't be picked up in the "greater than" version case.

In terms of the owner wanting to have it taken down, there should probably be a licence flag that hands control over to the host so at the very least an audit can be carried out before removal.

EDIT some discussion rather than downvotes would be nice. In this case we have a library with a totally permissive license, used by screeds of other libraries, with 2.4M downloads a month. The pragmatist in me says that there should be some mechanism by which pushing a button shouldn't screw up everyone's day. Let's discuss potential solutions.
Ignoring the Schafer comments... it's 15 dollars. Depending on your locale, this is probably roughly the price of a movie ticket.

It's odd to me that people value games so little. A quick look suggests this is at least 6 hours of game play. Seems like a fine price for 6 hours of entertainment, especially if you've never played the original.
ooh gosh, they should really do something like ban new projects from using those names until they figure out a better solution, hopefully with the module author.
I really wish they'd taken the style into consideration instead of just redrawing the characters - the colored outlines worked really well at a small resolution, but they look really weird when you scale them up.
Please: Do not use CoffeeScript in your examples.

It is not common to have "readability" in CoffeeScript and it restricts a significant number of readers from being able to understand the code sample.
Few people would describe RSA as a patent troll. Few people would describe Intellectual Ventures as anything but. In between, there's a wide spectrum of entities with varying degrees of contribution, sympathy, and abuse. Whether any particular litigant qualifies as a patent troll depends heavily on who is speaking.

As far as definitions of "abuse", for one definition, see http://patentlyo.com/patent/2011/09/rader-patent-litigation.... : 'someone simply seeking litigation-cost settlements, or, in other words, "any party that attempts to enforce a patent far beyond its actual value or contribution to the prior art."' Newegg provided another clear and concise definition; both seem quite reasonable.

The phrase "foam-arrow lawsuit" suggests rather strongly that those definitions probably apply here.

The phrase as used by Newegg had the desired effect with their target audiences. And if using the phrase "patent troll" contributes to increased vilification of offensive patent use in general, I don't have any problem with that, either.
>technology is responsible for most fossil fuel emissions and pollution.

No, that was people. Inanimate concepts don't have agency.
a) from what I understand, his project was there first.

b) NPM shouldn't have to fight it unless they are requested to, the trademark claim was ridiculous to begin with. Regardless of the claim, enforcing it would have taken years... I'm not saying NPM shouldn't have comply with the request and rename the package but definitely could/should have handled this better.

c) the guy wrote: "NPM is no longer a place that I’ll share my open source work at, so, I’ve just unpublished all my modules." I think it's pretty clear why we pull all of his modules.
By this logic, every Stack Overflow snippet should be a module. I'm almost hesitant to suggest this since many people who read this will be capable of building such a thing.
It occurs to me that DotT, along with Full Throttle, Grim Fandango, Curse of Monkey Island, The Dig, Sam and Max, and a whole bunch of other IPs are now owned by Disney.
Almost, but the existing code only pads when the str length is less than that of len.
By never revealing the IP address of the origin. Conceal it completely behind CF. A properly configured CF setup will mean your real server IP never gets revealed ever.
Here's a definition of abuse: filing a lawsuit they don't expect to win on the merits, but offering to settle for an amount small enough to make settling rational in the short term for the victim.
It sounds like email, but limited to 140 characters!
I've never felt good any time I have to use node modules and see this gigantic stream of dependencies come flying down. It's even more painful when you need to assemble license information for your software and crawl through _every single dependency and all of their dependencies_ to find their licenses, etc. to check they are OK to use in your software. Just look at the View License info in the Atom text editor some time for a truly insane wall of text (over 12,000 lines!!). IMHO the entire node / NPM system is seriously flawed with so many tiny dependencies for trivial stuff.
OVH will nullroute you in about 3 seconds if you're affecting the stability of their network. I've been hit with a very large DDoS attack before, and our host nullrouted us because the attack was causing instability for our neighbors in the rack due to the switch being flooded with too much traffic.
Seems a bit unlikely given Travis Kalanick's various statements that he doesn't want to do that kind of stuff.
You're not expected to invent the recipe for bread though - you're allowed to talk to people and find the best recipe, and if it's acceptable quality then you use that.

EDIT: Unless your job is to invent a better bread recipe.
https://conferences.oreilly.com/oscon/open-source-us/public/...

the price is pretty deep though
> There are no legal claims to be made over NPM package names.

Why not? An NPM package name is the name of a piece of software, and software names are very much covered under trademark law.
The caret character is a specification in NPM, not semver. It's designed to work within the semantic versioning rules to ensure you get the latest version which includes bug fixes, but also won't include breaking changes.

For example, ^1.3.2 will allow anything greater than 1.3.2 but not 2.0.0. It also has special behaviour that makes it more strict for projects with a major version of 0. If your dependencies follow semver then you'll get bug fixes and security updates without having to do anything or worry about breaking changes.

More info: https://nodesource.com/blog/semver-tilde-and-caret/
Is that really silly? Coming up with a project name in an unrelated project in the technology space? That's akin to Ajax Detergent (https://en.wikipedia.org/wiki/Ajax_(cleaning_product)) wanting all jQuery wiped off because there is a $.ajax() function in jQuery. Look, it even has a $! Chaching with every occurrence!
> the trademark claim was ridiculous to begin with.

npm's lawyers disagree with you, and they're lawyers.

EDIT: cool HN, -2 for stating a fact. Sure, I don't disagree that this lawsuit is kind of silly, but npm's laywers don't think this suit is _frivolous_, which is what matters.
Trademark fields are broad AFAIK. "Digital stuff" is a single category, and both kik the messenger and azer's kik fall there.
SV Angel Co-Founder David Lee Launches New VC Firm
Author here. L++ (Lisp-flavored C++) https://bitbucket.org/ktg/l
yes, let's blow up the entire concept that's worked fine for the ~5 years of node's existence because one dude did something extreme.
+1 also US Trademark != the whole world. NPM should have handle this better!
Ahh yes, this is a thought I've been struggling with for a while - thank you for the mental clarification.
Does anyone else think the "captain's chair" looks like it came out of a Star Trek movie?
It gets worse than that.

https://www.npmjs.com/package/uniq
https://www.npmjs.com/package/array-uniq
https://www.npmjs.com/package/array-unique
What's "flip-flopping"? The package restored is not the one the trademark issues were about.
The Machine to Build the Machines – NeXT
I'm not saying that everything should be a module, but that well designed, well tested bits of code should be modules.

These 17 lines had 100% test coverage and were used by a stupidly large amount of people (read: battle tested), why not use it?

As is pointed out elsewhere in this thread, echo.c is roughly the same size, does that mean it's not a worthy program?
It's so easy to avoid name collisions that it doesn't even make much sense to think about it. And trademarks aren't even a feature of the capitalism he so seems to hate: OSS uses names for the same marketing purpose as companies do and larger projects register those trademarks.
I think you're mistaken about the caret semver specifier. Using the caret for versions less than 0.1.0 offers no flexibility at all.

For 0.0.x versions of packages the caret means "this version and this version only", so it won't break anything here...

Source: https://docs.npmjs.com/misc/semver#caret-ranges-123-025-004
FYI I'm the one who republished left-pad after it was unpublished.

I think of it similar to letting a domain name expire. The original author removed the code and I forked it and published a new version with the same package name.

The main issue was there were so many hard coded dependencies to 0.0.3 so I asked npm support if they could allow me to re-publish that version and they complied since I was now the maintainer of that package.
Your dismissal seems to elide the word questionable.

Back in the dark ages of computing, AT&T had a patent on the concept of "backing store" for windows, that is, the notion that if you had a GUI with two overlapping windows, you could save the state of the window underneath the other one rather than having to redraw the entire window when the top window moves or is closed. This is an extremely questionable patent; AT&T didn't even invent this -- Lisp machines did that, too, but they didn't try to patent it because it's blindingly obvious.

AT&T should never have been granted this patent, and their engineers had to know it. I would argue that "patent troll," although the term didn't exist back then, absolutely applies here, regardless of whether AT&T happened to be shipping their own system that used a backing store. Maybe your personal definition of "patent troll" requires the troll to be an NPE, but an awful lot of people would consider Wikipedia's definition to be more on point than yours: "a patent troll is a person or company that attempts to enforce patent rights against accused infringers far beyond the patent's actual value or contribution to the prior art."
I was a backer and although I didn't get into the game, it was easily worth it for the documentary alone.
Ideas for improvement:

- Add 2 factor authentication for npm publish

- When you npm install, add a warning for all the versions that got published without 2 fac

- pre-install/post-install scripts should require user to accept or refuse. The simple action of running npm install shouldn't run arbitrary code.

- make shrinkwrap by default (and fix all the issues with it) so that running npm install doesn't use different versions when used over time.

- make updating a version an explicit decision via npm upgrade
You can still do npm install / npm update, just do git add -A node_modules && git commit right after.
Wow, this is an amazing outcome here.

Why is "unpublishing" something that can happen in npm? What's the point? I can see the downside, what's the upside?
On a total aside, I wonder what VFX house they got to do this, because it all looks great. Usually these random corporate concept videos all look really cheesy.
How does a 30-day notice work unless you have a way of reaching out to people using your modules? It just seemed so unrealistic that even 1% of people would actually see such a notice before things start to fall apart.
Ah, I've published a paper that is a contribution!
left-pad is used in babel. And a lot of ppl use babel
Wiping out a malicious campaign abusing chinese ad platform.
Large-ish discussion from earlier thread: https://news.ycombinator.com/item?id=7987146
Creative Hacker needed for Gift Card Business DHQprivate@gmail.com
Yes if you start from the axiomatic base that the earth is flat, a lot of people around you are starting to sound awfully silly.

Then you realize that if your assumptions are wrong, any conclusion from them is valid.
Listen Debbie Downer, the methane inversion that will happen in the oceans and is already happening in the tundra will cause runaway global warming before the reefs are dissolved.

The best case scenarios are 1) global collapse of civilization or (and the one I am rooting for) 2) fusion power comes online and we use it to remove all of the excess carbon from the oceans and the atmosphere.
Thank you for fixing something that should have never been an issue. You allowed many developers to have a life after work :)
"Small business owners will work 60 hours a week so they don't have to work 40 hours for someone else." is the quote I'm reminded of.
Apple Watch Gallery
well, I mean what's the point of the project if it's JUST to run linux commands? we already have Bellard's JS VM for that

OR

maybe I didn't see their long-term goal?
If NPM wants to stay relevant and a serious contender, they need to have more clear policies in case of IP issues. In this case, the companies weren't even in the same space. Republishing someone's package who has chosen to unpublish and leave your platform is akin to Facebook resurrecting a Facebook profile because they had a lot of friends and the social circle ripple effects would be too high for feed quality for other users, so they chose to reactive the account AGAINST the author's wishes. WHAT?!?
We need an open source NPM alternative, yesterday.
Atom.io is not impacted, I think it's a good thing that apm is running on its own network.
Right, I know about that. What I'm pointing out is that anaconda doesn't support http://docs.python-guide.org/en/latest/dev/virtualenvs/

It's nice that they have an env tool, but why didn't they just use the existing virtualenv?
What's the point of this question, if you're just going to define away anything that disagrees with your apparent point?
This seems like a serious security risk. Is there any solution? Would using version numbers without the caret work?
Presumably, if the original author had changed the licence and pushed to npm prior to change of ownership then npm wouldn't have been able to do this?

Sounds like we could start seeing npm specific releases with different licences to the github repo (or npm specific branches with different licencing)

Obviously npm could re-publish the non npm specific code, but that would be more manual than a simple revert of an unpublish.
I for one wholeheartedly support him. The more collateral damage he causes, the more people are awareness he raises. While the solution to his problem is unclear at this point, it'll at least get us talking, and find out what all of the stakeholders can do better next time, and we as a community to prevent this from ever happening again. I entirely supports his actions.
> I think snake_case is more readable than CamelCase...

It might actually be more readable. See Sharif & Maletic (2010) [0]. Unfortunately, like many studies of its kind, it suffers from a tiny sample size and various experimental flaws. However, I still think it's interesting, and I think this kind of research is very important---if only it could draw more funding!

[0]: http://www.cs.kent.edu/~jmaletic/papers/ICPC2010-CamelCaseUn...
YC Lessons From Two Latin Americans Who Walked Into Silicon Valley
US trademark is what's dangerous to NPM Inc., the US company running NPM. We don't know anything about how they "handled" it before it came to this, except that they did decide against the article author. What should they have done differently?

It's not good that NPM-the-piece-of-infrastructure is vulnerable to this, maybe a registry like this shouldn't be under control of a single company, but we don't know enough to decide what options NPM Inc-the-company had.

I hope they clean up/better communicate their policies around this, once they have them figured out (e.g. the package dispute page doesn't discuss trademarks).
Hacker for Git Card Application Sought/ Equity ROI
Any Hackers out there who can HELP design/develop a Payment Gateway Application for Gift Card Start UP business. Take Equity in Biz for Greater Returns. DHQprivate at gmail (Darrell)
> Why would you assume I would bring up wet lab work in the context of mathematics?

I was asking.

Okay. Graph theory, etc.
Ask HN: What makes a Senior Dev
What makes a entry level, mid level senior dev?
Erm, that's not a very good example. You're pointing out some ancient source file from back when unix had no package management. These days echo.c is part of coreutils, a large package which is economic to manage dependencies for at scale.

It's interesting to think about the distinction between promiscuous dependencies (as pioneered by Gemfile) and the Unix way. I like the latter and loathe the former, but maybe I'm wrong. Can someone think of a better example? Is there a modern dpkg/rpm/yum package with <50 LoC of payload?

Edit: Incidentally, I just checked and echo.c in coreutils 8.25 weighs in at 194 LoC (excluding comments, empty lines and just curly braces). And that doesn't even include other files that are needed to build echo. Back in 2013 I did a similar analysis for cat, and found that it required 36 thousand lines of code (just .c and .h files). It's my favorite example of the rot at Linux's core. There's many complaints you can make about Unix package management, but 'too many tiny dependencies' seems unlikely to be one of them.
No it won't... The caret specifier for 0.0.x packages means "this version and this version exactly".
Here's the HN discussionn from that earlier submission.

https://news.ycombinator.com/item?id=11144437
Maybe one language from each "family": Rust, Haskell, Prolog, Lisp, Erlang.
A few reasons off the top of my head:

* People sometimes accidentally publish bad info. Passwords, private keys, personal information, etc... being able to remove that is a big plus

* if a critical security issue were found in a package, removing that version and adding a new one will practically "force" updates to happen.
Sure, sure. If you've flashed a non-stock firmware all sorts of useful things become possible.
Ahh you are right, all makes sense now, thanks!
Dear NPM: Remove unpublish
Here's [1] a list of all modules that were liberated. Some serious land-grab opportunities there

[1]: https://gist.github.com/azer/db27417ee84b5f34a6ea
First, you should never have a dependency for 15 lines.

Second, you sound just like people when pointed at modern art says "I could have done that" and I believe the correct response is "you didn't."
As best I can tell, before NPM restored it, Azer had transferred ownership to somebody else, who wanted to republish the old version but couldn't. So they do appear to be respecting the maintainer's wishes.
What dependencies are required? I would have thought that for basic, no-frills use, you could just load react.js and use it with no other dependencies. Are you referring to the tooling setup required for JSX? I've never used react, just curious.
a2x should be provided by the asciidoc package on your distribution. It's used to compile man pages.

I'd merge a pull request adding libsexl support!
Also, they've been around for several years, versus this guy's "kik" project which was created in late October 2015.

It seems like a legitimate complaint, IMO.
Layers tend to be conservative, and have also been known to make mistakes. I don't think it's crazy to question their decisions.
3 letters of a NPM developers package? for real?? I'm pretty sure the owners of Kik wouldn't care that that developer package is named Kik. I can find 1000s of mentions of Kik online which validates the trademark. Starting from @kik on twitter to an online project of a random student.

Pursuing a NPM package names?????? for real?!

If you've ever worked with lawyers you would have known that they would always be on the conservative (safe) side without understand the business implications.
I think that unfortunately this was a foregone conclusion. Copyright law, like most other laws in our society, favor corporate interests.

I support his stand on principal, however. Azer is a talented developer and has an impressive life story, and has certainly contributed more to society than a social network well know for invading children's privacy.

https://medium.com/@azerbike/i-owe-my-career-to-an-iraqi-imm...

https://en.wikipedia.org/wiki/Kik_Messenger#Controversies
trademarks do not work this way. in order to infringe on trademark, you actually have to be in the same business. OP did not want to fight a legal fight, which is understandable. And NPM can on their own discretion to do whatever they want, and they prefer to avoid legal battles as well.
The patents in question are from 2011 and on:

Publication number	US8449413 B1
Publication type	Grant
Application number	US 13/311,641
Publication date	May 28, 2013
Priority date	Dec 6, 2011

Publication number	US8932159 B2
Publication type	Grant
Application number	US 13/871,537
Publication date	Jan 13, 2015
Filing date	Apr 26, 2013
Priority date	Apr 26, 2013

It looks like iDV, where this dude buy's his arrows to resell falls under prior art as their stuff is shown in YouTube videos as far back as at least 2010:

https://www.youtube.com/watch?v=KVdHnANZ2o0