He didn't just post the code on github; he had publish rights on npm, which is where node developers are supposed to publish code they want other node developers to use. Lots of other node developers used it. Then he gave the publish rights on npm to someone else and didn't tell anyone.
If you're entirely ok with that, you're basically telling any node developer not to trust npm. Which basically breaks all of node development. Is that your intent?
> It wasn't Dominic's job, because you (and everyone else!) wasn't paying him.
I see you are not clear on the concept of a volunteer job. If lots of people use your code and you don't give them any indication that (a) you're no longer actively maintaining it (as someone noted in the github comment thread, he could have archived the repo long before this happened since he was no longer actively maintaining it and hadn't been for years), and (b) that you gave the npm publish rights to someone else, then, whether you like it or not, it was your job and you failed to do it. You made a promise to all those other developers and then you broke it.
If your argument is that nobody will do open source development for free under those conditions, then there is a lot of evidence over the past few decades to prove you wrong. But nobody is forcing you to do open source development for free under those conditions. It's everyone's free choice whether they're willing to put their code out there and whether they're willing to actively maintain it for free once it's out there. What you can't do is change your mind and not tell anyone. If Dominic realized that he didn't want to commit to maintenance for lots of developers for free, he should have archived the repo to make that clear.
Literally not according to you. One 'git push origin master' and our contributor has signed up to your requirements.
Dominic made no promises to anyone -- he offered the world something and said they could use it if they wanted. Full stop.
I made no such claim. Did you read what I actually wrote?
> Dominic made no promises to anyone
Not by putting his code up on github, no. But that's not all he did.
> Not by putting his code up on github, no. But that's not all he did.
I don’t see how putting your code on npm is fundamentally any different.
No one is entitled to free maintenance of gratis software forever, just because someone once said “npm publish”.
That’s not how open source works. It works by people contributing and getting involved, as opposed to entitled freeloading.
I have made no such claim. If he didn't want to maintain it any more, he could have said "npm deprecate" and that would have been fine.
What's not fine is to say "npm publish", then actively maintain the software for years, then decide you don't want to any more (which, in itself, is fine, it's your choice how much effort you want to put in), but not tell anyone, not deprecate, not send any signal that you have changed your commitment to the package--and then hand over publish rights to some random person who emails you, also without telling anyone.
If you think that is fine, then, as I said several posts upthread in response to another poster, you've basically said no developers should ever trust npm, because people who say "npm publish" are making no commitment whatever, not even to say "npm deprecate" if they don't want to maintain the package any more, or to tell anyone if they decide to hand maintenance over to some other random person. That is not how open source works.
Nobody should. At least not blindly. You should check what updates are and who made them. On every update.
Anything else is irresponsible and your own god damn fault when things go wrong.
> That is not how open source works.
npm is a proprietary package-repo and has nothing to do with how open source works. You can also easily publish proprietary packages using npm.
It wasn't Dominic's job, because you (and everyone else!) wasn't paying him.