Mike Roberts

This seems like a reasonable approach. It does bracket some of the larger issues that the left-pad debacle foregrounded (dispute resolution and the potential of malicious devs to release dangerous code), but it is a good step forward. Restricting unpublish will prevent some major catastrophes in the future. The issue of a malicious user publishing an incremented version with bad code still stands (as a patch semver release on a package that's not 0.X), but that's not particular to npm. It's just part of the trust ecosystem. The issue of conflict resolution is a thornier one. The medium post by the people at kik [0] paints Azer in a slightly less flattering light. His actions aren't precisely sympathetic, especially since the people at kik and npm both attempted to amicably resolve the problem (and Kik has a legit beef here). Conflict resolution is hard to programmatically / procedurally resolve, and in the case of a limited namespace (more people should use scopes, I guess) there's a real issue when you're releasing a package with the same name as something with registered trademarks in the same domain. Argue with trademark law if you want, and the use-it-or-lose-it features it has, but don't get mad at npm and Isaacs for following the lawyer's lead, especially with Azer's general attitude throughout the exchange. 0: https://medium.com/@mproberts/a-discussion-about-the-breaking-of-the-i…

IIRC, it was npm (not node) that rolled over and gave it to kik just because they felt like it would be "confusing." http://blog.npmjs.org/post/141577284765/kik-left-pad-and-npm https://medium.com/@mproberts/a-discussion-about-the-breaking-of-the-i…

Would like to note that kik is the company that threatened to go after an open source developer and get accounts terminated because he wrote a library with the same name. https://medium.com/@mproberts/a-discussion-about-the-breaking-of-the-i…

Harassed? Really? The undisputed transcript[0] doesn't really support that view, in my opinion. [0] https://medium.com/@mproberts/a-discussion-about-the-breaking-of-the-i…

did you see how he responded to Kik's request? https://medium.com/@mproberts/a-discussion-about-the-breaking-of-the-i…

Based on the chats here: https://medium.com/@mproberts/a-discussion-about-the-breaking-of-the-i… It does seem that the first contact from NPM to Azer was to tell him they were taking his package. There does seem to be a gap there, so maybe there is more to it.

Probably not unless Kik will decide to create something for ruby: https://medium.com/@mproberts/a-discussion-about-the-breaking-of-the-i…

> Honestly, I wouldn’t be surprised if some NPM build crashed even at Kik’s own headquarters today Humorously, this did happen. From the medium post by kik[0]: I found out about this problem like a lot of you, when our builds started failing because we use the extremely helpful JSCS. Through a long chain of dependencies, JSCS relied on [email protected], which was removed by the author yesterday. Our team was confused at the time as well. [0]: https://medium.com/@mproberts/a-discussion-about-the-breaking-of-the-i…

Hi everyone, please read this explanation from Kik's head of messenger about how this played out: https://medium.com/@mproberts/a-discussion-about-the-breaking-of-the-i… We're sorry for our part in creating the impression that this was anything more than a polite request to use the Kik package name for an upcoming open source project.

Who was the dick? Kik: Give us your package name Azer: No im using it Kik: not being a dick, but give it to us or we will start legal action Azer: That is being a dick.. Kik: (ccs npm) we will compensate you Azer: it will cost 30k because you are being dicks Kik: (ccs npm) he is breaching your terms by calling us dicks, please give me the package name Npm: Here you go kik, have the module name. Kik: Thanks npm. Azer: ????? https://medium.com/@mproberts/a-discussion-about-the-breaking-of-the-i… To clarify, they had NO RIGHT to the name. At the time, their trademarks did not cover the relevant category [1], it wasnt until a MONTH AFTER the dispute that they registered in a category that could even potentially cover its prior use [2]. NPM just gave it to them because they felt like it, not because they were obliged to. NPM even made a statement to this effect at the time. NPMs choice of course (well, Isaacs at the time) - but lets not pretend this was about trademarks - this was corporate bullying. [1] https://tmsearch.uspto.gov/bin/showfield?f=doc&state=4802:u683la.2… (sep 2015) [2] https://tmsearch.uspto.gov/bin/showfield?f=doc&state=4802:u683la.2… (apr 2016)

Maybe they're still angry with him about leftpad.</joke> Yes, it really is the same guy: https://kodfabrik.com/journal/i-ve-just-liberated-my-modules. And, joking aside it would be wise to bear in mind that we're reading only one side of the story here. As with leftpad, there's another side to this. With leftpad he told Kik, "fuck you" (https://medium.com/@mproberts/a-discussion-about-the-breaking-of-the-i… and then wrought global havoc on npm users. Now he's claiming the Chrome Extension Team "continuously troll developers", and is pulling down something he's created... again. I only have two data points, so the behaviour here is a coincidence rather than a pattern, but I will guarantee you whatever you think of Google there is more to this than meets the eye. I'm not without sympathy for the author, but neither am I about to uncritically take his side.

https://news.ycombinator.com/item?id=11341285 Your claim of misremembering is vacuous. I never claimed Bob called Azer a pussy. >Just so we're clear, you're saying that if someone fucks you over illegally, Just so we are clear, I never said that. If you believe otherwise, you'll need to produce a quote. Your hypothetical is baseless as kik was not "fucked over illegally". kik can't produce a Trademark. Azer didn't even know who kik was. > In fact, once Azer had made it clear that he wasn’t going to change the name, we decided to use a different name for an upcoming package we are going to publish to NPM. We did hope that Azer would change his mind, but we were proceeding under a different package name even when we were told we could have the name Kik. https://medium.com/@mproberts/a-discussion-about-the-breaking-of-the-i… I may get to the rest later today.

Kik (the company) wanted to publish an npm module using their trademarked company name[1]. As has long been npm's policy, they asked the trademark holder and the author to work it out amicably. Azer handled the situation about as gracefully as you'd expect from someone who published a module without checking if the name was clear and rage-quit when that decision bit him, bitching about "corporations" and stranding the countless developers who (eventually) depended on one of his modules. npm and Kik did most-everything right. The problem was in unpublishing already published tags. Once a tag is published, it shouldn't be able to be unpublished except in the most extenuating circumstances (perhaps a brand-new tag that inadvertently included PII). After a name changes hands, the new owner shouldn't be able to publish a new build in any of the major versions the previous owner tagged. Moreover, wholesale unpublishing modules shouldn't be allowed for the exact reasons this incident demonstrated. Based on npm's response, it sounds like they've learned that. [1]: https://medium.com/@mproberts/a-discussion-about-the-breaking-of-the-i…