Hacker News Reader

In the case of colors.js, since it was MIT licensed, anyone who has a copy of it is able to use it for free, and provide it to others for free, even if the author decides to charge for it. Maybe this is a wakeup call for developers not to blindly include dependencies in their projects, in case this happens again. Maybe you should always fork a repo and include your fork, and only selectively merge in upstream changes.

View on HN

Good point however developer could still have decided to remove the MIT license and licensed code and re-write or remove those licensed bits entirely, and then start charging money for it. I wonder if Github would have still considered that malicious and suspended him for it? I guess it's some sort of new unwritten rule on Github: thou shall not remove features from one's own project that others depend on.

GitHub public projects are free of charge, for the benefit of the community. It's good for the community that massively breaking changes that break every single consumer, are quickly fixed, even if the author wants to break the software. The author is free to publish their breaking changes elsewhere.

I think it’s more realistic to keep the current system where you download packages and updates from npm. The issue is rare, not every package is that popular and destroyed by their author, and it has been fixed quickly. Forking is easy but maintaining a fork, including security updates in a short time, is a lot of work and I doubt many developers would actually do it.

Reply on news.ycombinator.com