Mike Roberts, a Kik cofounder, posts a transcript of the dispute over the npm package name 'kik' that preceded the left-pad incident.
HN links it as the primary record of the Kik and npm dispute; commenters disagree on whether it shows harassment or a reasonable request.
This seems like a reasonable approach. It does bracket some of the larger issues that the left-pad debacle foregrounded (dispute resolution and the potential of malicious devs to release dangerous code), but it is a good step forward. Restricting unpublish will prevent some major catastrophes in the future.
The issue of a malicious user publishing an incremented version with bad code still stands (as a patch semver release on a package that's not 0.X), but that's not particular to npm. It's just part of the trust ecosystem.
The issue of conflict resolution is a thornier one. The medium post by the people at kik [0] paints Azer in a slightly less flattering light. His actions aren't precisely sympathetic, especially since the people at kik and npm both attempted to amicably resolve the problem (and Kik has a legit beef here). Conflict resolution is hard to programmatically / procedurally resolve, and in the case of a limited namespace (more people should use scopes, I guess) there's a real issue when you're releasing a package with the same name as something with registered trademarks in the same domain. Argue with trademark law if you want, and the use-it-or-lose-it features it has, but don't get mad at npm and Isaacs for following the lawyer's lead, especially with Azer's general attitude throughout the exchange.
0: https://medium.com/@mproberts/a-discussion-about-the-breaking-of-the-internet-3d4d2a83aa4d
Who was the dick?
Kik: Give us your package name
Azer: No im using it
Kik: not being a dick, but give it to us or we will start legal action
Azer: That is being a dick..
Kik: (ccs npm) we will compensate you
Azer: it will cost 30k because you are being dicks
Kik: (ccs npm) he is breaching your terms by calling us dicks, please give me the package name
Npm: Here you go kik, have the module name.
Kik: Thanks npm.
Azer: ?????
https://medium.com/@mproberts/a-discussion-about-the-breaking-of-the-internet-3d4d2a83aa4d
To clarify, they had NO RIGHT to the name. At the time, their trademarks did not cover the relevant category [1], it wasnt until a MONTH AFTER the dispute that they registered in a category that could even potentially cover its prior use [2]. NPM just gave it to them because they felt like it, not because they were obliged to. NPM even made a statement to this effect at the time. NPMs choice of course (well, Isaacs at the time) - but lets not pretend this was about trademarks - this was corporate bullying.
[1] https://tmsearch.uspto.gov/bin/showfield?f=doc&state=4802:u683la.2.31 (sep 2015)
[2] https://tmsearch.uspto.gov/bin/showfield?f=doc&state=4802:u683la.2.32 (apr 2016)
Kik (the company) wanted to publish an npm module using their trademarked company name[1]. As has long been npm's policy, they asked the trademark holder and the author to work it out amicably. Azer handled the situation about as gracefully as you'd expect from someone who published a module without checking if the name was clear and rage-quit when that decision bit him, bitching about "corporations" and stranding the countless developers who (eventually) depended on one of his modules.
npm and Kik did most-everything right. The problem was in unpublishing already published tags. Once a tag is published, it shouldn't be able to be unpublished except in the most extenuating circumstances (perhaps a brand-new tag that inadvertently included PII). After a name changes hands, the new owner shouldn't be able to publish a new build in any of the major versions the previous owner tagged. Moreover, wholesale unpublishing modules shouldn't be allowed for the exact reasons this incident demonstrated. Based on npm's response, it sounds like they've learned that.
[1]: https://medium.com/@mproberts/a-discussion-about-the-breaking-of-the-internet-3d4d2a83aa4d#.zgf76kuk3
https://news.ycombinator.com/item?id=11341285
Your claim of misremembering is vacuous. I never claimed Bob called Azer a pussy.
>Just so we're clear, you're saying that if someone fucks you over illegally,
Just so we are clear, I never said that. If you believe otherwise, you'll need to produce a quote. Your hypothetical is baseless as kik was not "fucked over illegally". kik can't produce a Trademark. Azer didn't even know who kik was.
> In fact, once Azer had made it clear that he wasn’t going to change the name, we decided to use a different name for an upcoming package we are going to publish to NPM. We did hope that Azer would change his mind, but we were proceeding under a different package name even when we were told we could have the name Kik. https://medium.com/@mproberts/a-discussion-about-the-breaking-of-the-internet-3d4d2a83aa4d#.hz69bhd5q
I may get to the rest later today.
Maybe they're still angry with him about leftpad.</joke>
Yes, it really is the same guy: https://kodfabrik.com/journal/i-ve-just-liberated-my-modules. And, joking aside it would be wise to bear in mind that we're reading only one side of the story here. As with leftpad, there's another side to this.
With leftpad he told Kik, "fuck you" (https://medium.com/@mproberts/a-discussion-about-the-breaking-of-the-internet-3d4d2a83aa4d#.ld8o5zqz7), and then wrought global havoc on npm users. Now he's claiming the Chrome Extension Team "continuously troll developers", and is pulling down something he's created... again.
I only have two data points, so the behaviour here is a coincidence rather than a pattern, but I will guarantee you whatever you think of Google there is more to this than meets the eye.
I'm not without sympathy for the author, but neither am I about to uncritically take his side.
> Honestly, I wouldn’t be surprised if some NPM build crashed even at Kik’s own headquarters today
Humorously, this did happen. From the medium post by kik[0]:
I found out about this problem like a lot of you, when our builds started failing because we use the extremely helpful JSCS. Through a long chain of dependencies, JSCS relied on left-pad@0.0.3, which was removed by the author yesterday. Our team was confused at the time as well.
[0]: https://medium.com/@mproberts/a-discussion-about-the-breaking-of-the-internet-3d4d2a83aa4d#.dybfpmjas