What NPM should do to stop a new colors attack

Re:What NPM should do to stop a new colors attack by _fat_santa on Monday January 10, 2022 @12:41PM (#29878453)

Personally I think he did it to prove a point. IIRC he made a post last year where he said he would no longer be developing software for companies to use for free. This gripe is that he does all this work for free and companies then use his code to make money and do not contribute back to the ecosystem.

IMO this was not the most graceful way to make the point, but at the end of the day it's his project, his code. If you want the expectation of it always working, then pay him. Don't bitch and moan that the old man giving out free bread on the steps isn't here this morning.

[ Parent | on HN ]

Re:What NPM should do to stop a new colors attack by peoplefromibiza on Monday January 10, 2022 @02:34PM (#29880551)

> he made a post last year where he said he would no longer be developing software for companies to use for free

I understand the sentiment, but why chose MIT license then?

GPL would be the right choice if one wants to stop companies profiting from free work without giving anything back.

[ Parent | on HN ]

Re:What NPM should do to stop a new colors attack by selfhoster11 on Monday January 10, 2022 @04:18PM (#29882690)

Perhaps by the time he started feeling this way, it was too late to relicense? Megacorps would just fork from a pre-GPL release and carry on.

[ Parent | on HN ]

Re:What NPM should do to stop a new colors attack by peoplefromibiza on Monday January 10, 2022 @04:29PM (#29882859)

that's my understansing as well.

I'm not judging the author here, but on one hand I understand the frustration, on the other hand the package probably owes its popularity in part to its very permissive license.

Anyway, a fork maintained by the companies that use the package would still be a better outcome than keep working for them for free (or remove the package entirely).

[ Parent | on HN ]

Re:What NPM should do to stop a new colors attack by accoil on Monday January 10, 2022 @04:15PM (#29882632)

Would GPL help though? It's a library used by tests, not part of the end product distributed to users.

[ Parent | on HN ]

Re:What NPM should do to stop a new colors attack by peoplefromibiza on Monday January 10, 2022 @04:24PM (#29882786)

I don't know in this case but in general a GPL fork must stay GPL and, AFAIUI, importing a GPL package in your code it's similar to linking to it, so if the code that uses your GPL package is published (on GH for example) that could be considered redistribution. Not sure about the legalities but it could create enough friction to keep companies not willing to contribute away.

[ Parent | on HN ]

Re:What NPM should do to stop a new colors attack by accoil on Monday January 10, 2022 @05:10PM (#29883477)

I guess I'm thinking more in terms of faker, which I believe was a library for creating test data. Makes me wonder if licenses matter much for tools that are never intended to be included in the final distribution.

Internal changes aren't going to be detectable, so it feels like the best you can hope for is that they don't want the maintenance burden of a patch set on top of your project. At that point it's not much different than MIT.

That said, AGPL would scare off most companies :p

[ Parent | on HN ]

Re:What NPM should do to stop a new colors attack by jraph on Monday January 10, 2022 @03:43PM (#29882063)

Yes, especially GPLv3. Still open source, and companies avoid it.

[ Parent | on HN ]

Re:What NPM should do to stop a new colors attack by watwut on Monday January 10, 2022 @06:02PM (#29884255)

License is pretty good starting point for that. Or, simply making closed source only as overwhelming majority of programmers do.

The whole "contributing to open source" while effectively saying "I think open source should not exist and is rip of" makes no sense in world where literally nothing forces you to create open source.

[ Parent | on HN ]