{"action":"created","issue":{"url":"https://api.github.com/repos/npm/npm/issues/10601","labels_url":"https://api.github.com/repos/npm/npm/issues/10601/labels{/name}","comments_url":"https://api.github.com/repos/npm/npm/issues/10601/comments","events_url":"https://api.github.com/repos/npm/npm/issues/10601/events","html_url":"https://github.com/npm/npm/issues/10601","id":119363432,"number":10601,"title":"Effect of acceptance terms in node.js 4.x.x, 5.x.x, and io.js 3.3.x","user":{"login":"scriptjs","id":13335501,"avatar_url":"https://avatars.githubusercontent.com/u/13335501?v=3","gravatar_id":"","url":"https://api.github.com/users/scriptjs","html_url":"https://github.com/scriptjs","followers_url":"https://api.github.com/users/scriptjs/followers","following_url":"https://api.github.com/users/scriptjs/following{/other_user}","gists_url":"https://api.github.com/users/scriptjs/gists{/gist_id}","starred_url":"https://api.github.com/users/scriptjs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/scriptjs/subscriptions","organizations_url":"https://api.github.com/users/scriptjs/orgs","repos_url":"https://api.github.com/users/scriptjs/repos","events_url":"https://api.github.com/users/scriptjs/events{/privacy}","received_events_url":"https://api.github.com/users/scriptjs/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/npm/npm/labels/support","name":"support","color":"FF91AF"}],"state":"closed","locked":false,"assignee":{"login":"isaacs","id":9287,"avatar_url":"https://avatars.githubusercontent.com/u/9287?v=3","gravatar_id":"","url":"https://api.github.com/users/isaacs","html_url":"https://github.com/isaacs","followers_url":"https://api.github.com/users/isaacs/followers","following_url":"https://api.github.com/users/isaacs/following{/other_user}","gists_url":"https://api.github.com/users/isaacs/gists{/gist_id}","starred_url":"https://api.github.com/users/isaacs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/isaacs/subscriptions","organizations_url":"https://api.github.com/users/isaacs/orgs","repos_url":"https://api.github.com/users/isaacs/repos","events_url":"https://api.github.com/users/isaacs/events{/privacy}","received_events_url":"https://api.github.com/users/isaacs/received_events","type":"User","site_admin":false},"milestone":null,"comments":3,"created_at":"2015-11-29T14:50:33Z","updated_at":"2015-12-08T18:26:28Z","closed_at":"2015-12-07T03:23:17Z","body":"The terms of service of NPM were included by reference in each copy of node downloaded since Sept 2015. These terms were attached to the Artistic License by NPM's lawyer. NPM is in the process of taking steps with v3.5.1 to resolve this but it has not yet come into any release of node.\r\n\r\nhttps://github.com/nodejs/node/issues/3959\r\n\r\nThat said, changes for the future do not remedy the hundreds of thousands (or more) downloads distributed and in use since Sept 2015 including all node 4.x.x  LTS and node 5.x.x stable software releases. This also involves io.js releases at 3.3.x.\r\n\r\nUsers had not been made aware of the changes to the license and entered into the terms without their knowledge and consent (as a result of the download). The terms also inferred ambiguous references that included among other things, a free license to use your code in any way NPM wants (whether it is open or closed source).\r\n\r\n```\r\nYou own Your Content, but grant npm a license to use it free of charge. \r\nThat license allows npm to do whatever it needs to do with your content, \r\nwithin reason, to provide and improve npm Services, for you and other users. \r\nThat license lasts, for each piece of Your Content, until the last copy disappears\r\nfrom npm's backups, caches, and other systems, after you delete it from the\r\nWebsite or the Public Registry.\r\n```\r\n\r\nMaking matters more confusing, the license user's believe they were accepting in the installer and that they see on the node site was not the same license that was bundled in in the node software itself.\r\n\r\nI am requesting that NPM prepare language to properly and publicly communicate to the community about the error and to advise users that may have inadvertently accepted NPMs terms of service on this basis, that they will NOT be bound to the terms of service of the NPM site if they do not use the service. In addition, to bind the terms to the License was a mistake that is being corrected with specific node patch releases."},"comment":{"url":"https://api.github.com/repos/npm/npm/issues/comments/162969475","html_url":"https://github.com/npm/npm/issues/10601#issuecomment-162969475","issue_url":"https://api.github.com/repos/npm/npm/issues/10601","id":162969475,"user":{"login":"isaacs","id":9287,"avatar_url":"https://avatars.githubusercontent.com/u/9287?v=3","gravatar_id":"","url":"https://api.github.com/users/isaacs","html_url":"https://github.com/isaacs","followers_url":"https://api.github.com/users/isaacs/followers","following_url":"https://api.github.com/users/isaacs/following{/other_user}","gists_url":"https://api.github.com/users/isaacs/gists{/gist_id}","starred_url":"https://api.github.com/users/isaacs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/isaacs/subscriptions","organizations_url":"https://api.github.com/users/isaacs/orgs","repos_url":"https://api.github.com/users/isaacs/repos","events_url":"https://api.github.com/users/isaacs/events{/privacy}","received_events_url":"https://api.github.com/users/isaacs/received_events","type":"User","site_admin":false},"created_at":"2015-12-08T18:26:28Z","updated_at":"2015-12-08T18:26:28Z","body":"The npm cli was never licensed under anything other than the Artistic License 2.0.  The additional terms did not apply to the cli itself, but to the use of npm registry services, website, and other products.\r\n\r\nThis has been pointed out to you several times.  Professional lawyers who have reviewed the situation (both working for npm as well as other parties) have said that this interpretation is accurate.\r\n\r\nIt wasn't clear enough, as your misunderstanding demonstrates.  We've clarified it.  That issue is over, and I have nothing more to say about it.\r\n\r\n> This goes beyond package distribution since your company has also been asserting itself with changes to the package.json. The manifest is something that is in the community interest and any changes ought to be highly consultative.\r\n\r\nI suspect that you're referring to the changes to how the npm cli warns on the `license` field using SPDX format.  Those changes were, in fact, highly consultative.\r\n\r\nI've asked you to stop claiming that we have asserted rights that we have not asserted.  Since you have not complied with that request, well past the bounds of good faith, this conversation is over."}}