News for hackers. Stuff that matters.
Re:What NPM should do to stop a new colors attack by sam0x17 on Tuesday January 11, 2022 @04:00PM (#29897801)
Because they are interfering with _his_ distribution of the code. They are free to distribute it separately and make changes in those cases, but instead they are essentially re-writing history without the knowledge of the package owner, and for reasons that are largely editorial and, I think, unprecedented. They are interfering with his right to distribution, essentially. I know that in a slimy, technical way, you are correct, but I think it is relevant if at the end of the day it is practically impossible to distribute code without some unauthorized third party modifying it in transit, essentially. The implication is we need to start running our own git servers.
Re:What NPM should do to stop a new colors attack by Macha on Tuesday January 11, 2022 @05:13PM (#29898884)
I feel that replacing a package with one that doesn't fulfil the same needs in a patch update because you feel that "no warranty implied" justified it is as much "slimy, technical" use of that license.

Again, if Marak is going to rely on technicalities, I don't blame npm for treating him with as much good faith as he treated his users.