Dispute over module name in npm registry became giant headache for developers.
The disruption caused by the wholesale unpublishing of code modules by their author Azer Koçulu was repaired in two hours, Schlueter told Ars, as other developers filled in the holes in the repository. The incident is, however, prompting Schlueter and the team at nmp Inc. to take a look at how to prevent one developer from causing so much collateral damage.
While the tools for npm are open source, the global public registry that it taps into is the service of a private company with venture capital backing. And npm, Inc., which aims to make revenue off private registries, treats the global public registry as an editorial product—a product that many developers have become dependent on to tap into a vast, automatically updated collection of open source code.
It’s an arrangement that has worked well, largely—except when it doesn’t. And this week, it suddenly didn’t.
Kik in the ass
In an e-mail to Koçulu on March 11, Bob Stratton of Kik explained the issue. “We’re reaching out to you as we’d very much like to use our name “kik” for an important package that we are going to release soon,” Stratton wrote. “Unfortunately, your use of kik (and kik-starter) mean that we can’t and our users will be confused and/or unable to find our package. Can we get you to rename your kik package?”
Koçulu replied an hour later, simply saying: “Sorry, I’m building an open source project with that name.”
This didn’t sit well with Kik (the company). Stratton responded the next day, saying “We don’t mean to be a dick about it, but it’s a registered trademark.” He then mentioned that if Koçulu went ahead with a project with that name, “our trademark lawyers are going to be banging on your door and taking down your accounts and stuff like that—and we’d have to do all that because you have to enforce trademarks or you lose them. Can we not come to some sort of a compromise to get you to change the name without involving lawyers?”
“Hahah, you’re actually being a dick,” Koçulu replied. “So, fuck you. Don’t e-mail me back.” After a final plea from Stratton, he answered, “Yeah, you can buy it for $30,000 for the hassle of giving up with my pet project for bunch of corporate dicks.”
At this point, Stratton and Kik pleaded with npm’s support team to help straighten things out. He sent several e-mails to npm, asking the support team to intervene. Schleuter made the call to give Kik the name and tried to diplomatically break it to Koçulu, expressing sympathy with his frustration.
“We have a very well documented policy for handling these disputes,” Schleuter told Ars. “It very quickly became obvious that they were not going to be able to resolve their dispute over the name. We made the decision based on what we thought would be in the best interest of the NPM community. What it came down to is that a reasonably well-informed user who types ‘npm install kik’ would expect to get something related to Kik. So that’s why we turned (the name) over.”
Koçulu did not take the decision well. “I know you for years and would never imagine you siding with corporate patent lawyers threatening open source contributors,” he wrote back. Disillusioned, Koçulu demanded, “I want all my modules to be deleted including my account, along with this package. I don’t wanna be a part of NPM anymore. If you don’t do it, let me know how do it quickly. I think I have the right of deleting all my stuff from NPM.”
Koçulu told Ars that Schleuter sent him a command to do just that. “The second email I got from NPM was the founder Isaac giving me a one-liner command that deletes all my stuff,” he said in an e-mail. And he used that command, deleting 273 modules he had registered in npm (though he left the modules available through GitHub).
In a post on Medium, Koçulu said, “This situation made me realize that NPM is someone’s private land where corporate is more powerful than the people, and I do open source because, Power To The People.”
“Indirectly, there were a couple of very large packages that depended upon left-pad,” Schleuter said. “So when that disappeared from the registry, their builds started breaking and people got very upset.”
Within ten minutes, as Schleuter describes in a blog post about the episode, developer Cameron Westland had stepped in and published a functionally equivalent version of left-pad. But it took a bit longer for all the collapsed stack of dependencies to be sorted out, since some of the code breaking specifically called a different version number than the one Westland had put on his left-pad. And the anger over the outage didn’t end when everything was declared fixed.
And yes, it is. A discussion over a user request to kill npm’s unpublish feature became heated, and when npm’s command-line interface team lead Forrest L Norvell locked the discussion “because I want to have an evening away from this,” it further fanned flames. The discussion thread has not yet been unlocked. James Nadeau wrote a long separate comment on npm’s GitHub portal, entitled “Should I trust npm?”, in which he expressed concerns many had raised:
(T)here has been a series of decisions, commitments, and actions that this project’s maintainers have taken that have eroded the trust of it’s users.[sic]
I can’t trust that a package will always be available.
I can’t trust npm will keep a published package around.
I can’t trust they will respect my actions of unpublishing something from npm.
I can’t trust that project maintainers will at least listen to my concerns.
I can’t trust…..
I imagine the number of people taking a look at how much they trust, need, and depend on npm right now is huge. I’m actively taking steps to mitigate how much I depend on this project to be available, and at what point in my development process I make use of it. I’ve talked to others doing the same.
I’m taking actions that demonstrate my loss of trust with this project. In doing so, I can see multiple ways in which the npm organization is much less involved with the work I produce. This series of thoughts doesn’t make me want to open up my wallet for you anytime soon. Quite the opposite.
Is this what you want your community members to be thinking and doing right now?
Update: In an e-mail to Ars late on March 25, Koçulu assessed what had happened as the result of his removal of his projects from npm. “Feeling very sorry for interrupting people’s work,” he said. “I did it for the benefit of the community in long term. NPM’s monopoly won’t be dictated to the free software community anymore.”
Read the original article over at ArsTechnica.com.