NPM today stands for Now Pay Me: JavaScript packaging biz debuts conduit for funding open-source coders NPM Inc, maintainer of the widely used JavaScript package manager npm, has taken a step toward fulfilling a promise made in August to help open-source developers seek compensation for their labor. Despite its own solvency concerns, the biz on Tuesday deployed code changes that add a "funding" command to the latest version of …
Well its better than CLI ads i guess, just dont see what value it adds to a package manager, dunno about everyone else but the only time i ever examine the meta data of a package is when i want to know where the packages project is hosted...
Still i guess if you view like spam, in so much that it only takes one person to respond per million emails sent to call it a sucessful campaign, then it might help, just think things like github sponsors is a more natural fit for this sort of thing.
Also whats the betting that in the next 6 months el reg reports on packages getting hacked to change the funding link to one not controlled by the authors, and whats the betting NPM's response is any more effective than shrugging and going meh??
Glad to see that the FIRST comment exposed this gaping security hole.
The only way this has even a chance of working is if they restrict the permitted hosts for funding & require significant vetting for changing the urls.
OTOH, we're talking about a 21st century attempt at shareware. We'll see how that goes.
Yup, when I read the words "all you need to do is set up a funding URL" I immediately thought "and all the hackers have to do is hijack that".
I totally agree on the principle, but JavaScript being the most hijacked thing in the IT world, I can't see how that will not attract all kinds of scum.
Still, at least they are trying something.
There are no good answers to getting support for free software, and its not sustainable and will not compete with funded proprietary systems and platforms until we find one. I like that they've given this a go; it seems a pretty harmless experiment, if it fails.
A better approach would be to revert to the old/new way. Yes the source code is free - feel free to download from GitHub et al and compile...; but want the convenience of automatically pulling the latest version, binary etc. then there is subscription for this...
"to help open-source developers seek compensation for their labor"
If a developer feels that donations are a form of "compensation", then they are not open-source developers. They probably also churn out shite that people shouldn't use.
An open-source developer is often one who makes money with a day job (probably doing similar) but then works on a project of passion to develop it "correctly" rather than under rushed deadlines or budget constraints. This process is its own reward and does not need "compensation". Yes, donations for beer are still very much appreciated but not *expected*.
I wonder what name we should give to developers who share their code (due to infrastructure requirements) but do not necessarily give any shites about it and just want money?
"I wonder what name we should give to developers who share their code (due to infrastructure requirements) but do not necessarily give any shites about it and just want money?"
"Open source developers"
Free software programmers respect the 4 freedoms. Open source programmers don't always respect the 4 freedoms.
The freedoms are:
(0) to run the program,
(1) to study and change the program in source code form,
(2) to redistribute exact copies, and
(3) to distribute modified versions.
Open source doesn't always guarantee the freedom to distribute exact copies or modified versions, or even the right to modify the software for private use.
If a developer feels that donations are a form of "compensation", then they are not open-source developers. They probably also churn out shite that people shouldn't use.
This is incorrect.
Bear in mind that many large companies are significant open source contributors (e.g. Red Hat), and the code that they contribute must therefore have been created by their employees who are paid a salary (a.k.a. compensation).
I'm not against paying for open source software. I've even been known to do so as well as contribute some spare change to Wikipedia and the Internet Archive.
Javascript On the other hand ... Is there someplace I can go to donate to a fund to eliminate the menace of website scripting -- not just Javascript, but ALL web scripting -- from humanity's future? I appreciate that it is a complex issue. There are worthy things -- interactive maps for example -- done with web scripting that would otherwise probably need to be provided by browsers. But the internet has become a rather bad neighborhood. And it's getting worse. And Javascript is clearly one of the reasons the neighborhood is going downhill.
"This is shallow thinking at its most obvious."
Sorry my friend, but I expect you'll eventually, probably after many years, conclude that Thomas Hobbes "The life of man in the natural state is solitary, poor, nasty, brutish and short." was a lot clearer thinker than Ayn Rand.
I'm sympathetic to Libertarianism. Any reasonable person is. I'd prefer a universe where Hobbes was wrong. But in practice, everybody does what they want and it all works out simply doesn't work. If you want problems solved, you tackle them -- mostly one at a time -- instead of throwing up your hands and saying "It can't be helped".
Right now, malicious web scripting is a problem. A serious one. Not a simple one. And it's getting worse, not better. I expect that Google and others will eventually try to tame it. They employee some very clever people. Maybe they'll succeed. But my bet would be otherwise.
But thanks for at least taking the time to express your viewpoint -- unlike the general population of apparently inarticulate and I suspect rather dimwitted downvoters around here.
Oh great, so all a hacker now has to do is change the package.json with a malicious link into the funding field link to divert funds.
Rather than going to the developers website and having a link off there to fund. After all, if I'm adding a module into the code, I want to know about it, find out how it's supported etc.
Who would trust the npm fund ... command?
"all a hacker has to do.."
All a hacker has to do is change the account number on all the money transfers in a bank and he will own all the money.
You talk like this can be done in a hand wave.
A hacker would have to steal the module developer's private keys or alter files in NPMs repositry to be able to compromise the module. And if that happens the fact that the "fund" commands points somewhere else is the least of anyone's concerns.
The functionality makes the repos very tasty targets, especially any which accidently publish private keys (happens a lot) plus spear fishing the devs and contributors of the project (cheers git (OK you should have a dedicated git spam address but still...)). While targeting the package distribution service would yeild equally good results, so you can popularity as a target will sky rocket.
Far better to leave funding a feature of the projects home page I think
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
