{"action":"created","issue":{"url":"https://api.github.com/repos/npm/policies/issues/44","repository_url":"https://api.github.com/repos/npm/policies","labels_url":"https://api.github.com/repos/npm/policies/issues/44/labels{/name}","comments_url":"https://api.github.com/repos/npm/policies/issues/44/comments","events_url":"https://api.github.com/repos/npm/policies/issues/44/events","html_url":"https://github.com/npm/policies/issues/44","id":144321547,"number":44,"title":"[meta issue] unpublish policy","user":{"login":"ashleygwilliams","id":1163554,"avatar_url":"https://avatars.githubusercontent.com/u/1163554?v=3","gravatar_id":"","url":"https://api.github.com/users/ashleygwilliams","html_url":"https://github.com/ashleygwilliams","followers_url":"https://api.github.com/users/ashleygwilliams/followers","following_url":"https://api.github.com/users/ashleygwilliams/following{/other_user}","gists_url":"https://api.github.com/users/ashleygwilliams/gists{/gist_id}","starred_url":"https://api.github.com/users/ashleygwilliams/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ashleygwilliams/subscriptions","organizations_url":"https://api.github.com/users/ashleygwilliams/orgs","repos_url":"https://api.github.com/users/ashleygwilliams/repos","events_url":"https://api.github.com/users/ashleygwilliams/events{/privacy}","received_events_url":"https://api.github.com/users/ashleygwilliams/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":105,"created_at":"2016-03-29T16:45:38Z","updated_at":"2016-04-01T17:16:16Z","closed_at":null,"body":"today we published a blog post on our first steps towards a new unpublish policy. \r\nthis issue is a place for readers to comment an ask questions **about the unpublish policy**.\r\ncomments and questions that are not specific to the unpublish policy will be moderated.\r\n\r\nlink to the blog post: http://blog.npmjs.org/post/141905368000/changes-to-npms-unpublish-policy\r\n\r\nremember: [npm has a Code of Conduct]\r\n\r\n[npm has a Code of Conduct]: https://www.npmjs.com/policies/conduct"},"comment":{"url":"https://api.github.com/repos/npm/policies/issues/comments/204475881","html_url":"https://github.com/npm/policies/issues/44#issuecomment-204475881","issue_url":"https://api.github.com/repos/npm/policies/issues/44","id":204475881,"user":{"login":"ashleygwilliams","id":1163554,"avatar_url":"https://avatars.githubusercontent.com/u/1163554?v=3","gravatar_id":"","url":"https://api.github.com/users/ashleygwilliams","html_url":"https://github.com/ashleygwilliams","followers_url":"https://api.github.com/users/ashleygwilliams/followers","following_url":"https://api.github.com/users/ashleygwilliams/following{/other_user}","gists_url":"https://api.github.com/users/ashleygwilliams/gists{/gist_id}","starred_url":"https://api.github.com/users/ashleygwilliams/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ashleygwilliams/subscriptions","organizations_url":"https://api.github.com/users/ashleygwilliams/orgs","repos_url":"https://api.github.com/users/ashleygwilliams/repos","events_url":"https://api.github.com/users/ashleygwilliams/events{/privacy}","received_events_url":"https://api.github.com/users/ashleygwilliams/received_events","type":"User","site_admin":false},"created_at":"2016-04-01T17:16:16Z","updated_at":"2016-04-01T17:16:16Z","body":"hey everyone!\r\n\r\nthank you very much for this discussion, i'll be answering as many of the questions asked here as possible and then i will be closing this thread at the end of the day. your participation was useful and i appreciate you all taking the time to share.\r\n\r\na couple of things that i would like to make as clear as possible:\r\n\r\n1. the restriction 24hr unpublish window has not been shipped yet, the blog post announced our intentions and authors who wish to unpublish right now may. we will let you know when the window has been implemented.\r\n2. while the unpublish policy is new, **our legal right to distribute code published to the registry indefinitely has been guaranteed by our terms for quite some time**. you agree to our terms when you publish to the registry whether you read them or not. again, **this legal right has everything to do with our terms and nothing to do with the license you assign your code**. \r\n3. this is the first step in our policy. the idea of abandoning a project or removing your association is interesting and being considered.\r\n\r\nnow to the questions:\r\n> What is the expected round trip time of a support human?\r\n\r\n24-72hrs, often faster\r\n\r\n> What percentage of NPM packages is \"stale\" e.g. not updated frequently? Are you tracking any statistics on the number of package authors whose linked github repositories are unresponsive?\r\n\r\nWe are not actively tracking, but have the ability to see user and package activity should we decide we needed such data.\r\n\r\n> Under what circumstances does a currently published package fall under these new rules? Did you send a note to all npm package authors asking them to consent?\r\n\r\nThis is policy does not require any change to our legal policy. We published this policy announcement and we ran this open issue as a forum for questions. support@npmjs.com and community@npmjs.com are also available for concerned users.\r\n\r\n> In the case of a legal challenge by the author(s) or rightsholders of the code in question, do you intend to defend your ability to continue publishing the package?\r\n\r\nOur terms, which you agree to when you publish a package to the registry, allow us the ability to distribute your code indefinitely. We are, and have been, legally within our ability to continuing distributing the package.\r\n\r\n> What are the thresholds used? Using humans implies judgment. If the package has one listed dependency, is that an issue? Ten? Twenty?\r\n\r\nThose thresholds will emerge from data we collect as we move forward with the policy. We don't claim to know which would be best at this point and will look to the data we collect for direction. \r\n\r\n> Are all packages treated the same way? What about a package that has never been downloaded?\r\n\r\nNope. Packages vary and that is why a human solution is best at this point until we can figure out if there are clearly defined thresholds. \r\n\r\nIf a package has no dependents and has never been downloaded unpublishing it is a pretty trivial decision. However, given the bot activity on the registry, there are no packages that have *never* been downloaded.\r\n\r\n> If your support humans get overloaded, at what point do you anticipate migrating to a more scalable system?\r\n\r\nWe'll have to see.\r\n\r\n> How long does your sensible support human expect to take resolving a package that desires an unpublish that other packages depend on and are unresponsive? Modulecounts suggests 250k packages currently in NPM. If we assume 1% of those packages might have these issues, that's 2500 total, with an additional 4 (1% of 446 average) a day, for a total of 1,460 over the course of a year. Are these statistics accurate?\r\n\r\nWe'll have to see how it goes. \r\n\r\n> What do you think the proposed contact mechanism is or should be for a developer who wishes to unpublish their package? \"Any means necessary\"? If a developer wishes to unpublish a package, do you accept their warranty that they've made all attempts to communicate to the people that depend on their package?\r\n\r\n\"Any means necessary\" is hyperbolic and definitely not endorsed by npm. Email seems sufficient.\r\n\r\n\"do you accept their warranty that they've made all attempts to communicate to the people that depend on their package?\" We trust our users and believe that they act in good faith. If there is little to no activity for packages dependent on the target of an unpublish, we may make a judgement call, though our tendency will be to be conservative in protecting the ecosystem. This is a Hard thing to do and this is why we are using people and not hard and fast thresholds.\r\n\r\n> If a developer thinks there is someone, or multiple someones, who are infringing their license for a given package, how does NPM propose to deal with that dispute? NPM's terms of service seem to indicate there is no avenue for a developer to stop such a package from being available to the infringer short of a lengthy court battle.\r\n\r\nIf you believe a person or persons is using your package in a way that infringes on your license you should get in touch with that person and ask them to stop. You may need to get a lawyer. npm is not, and has never promised to be, your lawyer. Our distribution of your code has nothing to do with the license you give it. Violations of the license you give your code is something you need to deal with.\r\n\r\nIf it happens that a package in the registry is infringing on your Trademark or Intellectual Property you can get in touch with us. If it is the case that your Trademark or IP is being violated, we will remove the package. An example of this is our DMCA policy: https://www.npmjs.com/policies/dmca\r\n\r\n> Does NPM intend to treat larger companies different than smaller companies when it comes to this policy?\r\n\r\nNo.\r\n\r\nThank you again for your participation and questions. This issue will be closed at the end of the day today (Midnight, EST)."}}