'npm init django' works, maybe let's stop that?

[Adam Johnson]

It has been brought to my attention[1] that running 'npm init django <projectname>' works.

This is due to the existence of a package called create-django on npm ( https://www.npmjs.com/package/create-django ). This package is 17 days old at time of writing. It starts a Python virtualenv, installs Django, and invokes startproject with an opinionated template.

Sometime in the past, a 'django' package was uploaded to npm, then someone from the DSF contacted npm and got it renamed due to the trademark and security risk of developers mixing up commands. ( https://www.npmjs.com/package/django -> https://www.npmjs.com/package/django-express )

I propose we again contact npm and request a rename of create-django and the holding of the name. This would avoid any confusion that the package is "official".

[1] https://www.reddit.com/r/django/comments/lz5sl7/stop_using_django_meme/gpzgmsz?utm_source=share&utm_medium=web2x&context=3

--

Adam

[James Bennett]

Any time this happens, just notify the DSF Board; they're the ones
with the legal standing to enforce the trademark.

[Adam Johnson]

I thought of this, but I also wanted to have the discussion out in the open before the decision that it’s a use of the trademark we want to stop. I guess we don’t have any other place for such a discussion?

On Mon, 8 Mar 2021 at 00:05, James Bennett <ubern...@gmail.com> wrote:

Any time this happens, just notify the DSF Board; they're the ones
with the legal standing to enforce the trademark.

--
You received this message because you are subscribed to the Google Groups "Django developers  (Contributions to Django itself)" group.
To unsubscribe from this group and stop receiving emails from it, send an email to django-develop...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/django-developers/CAL13Cg_%2B8qTkAFF82_6PrYt3BcTh_j6HtgHRQzKnn-D1XMD%2BMQ%40mail.gmail.com.

--

Adam

[Florian Apolloner]

I am in favor of removing such a package. FWIW I have been contacting the authors of https://pypi.org/project/Django-2.2.19/ and https://pypi.org/project/Django-504/ as well a few weeks ago (their packages list before or next to Django when searching for Django on PyPI and might create some confusion). Given that I received no answer in weeks I'll guess I'll ask the PyPI team to remove them. For me it is not as much a trademark issue in this case but mostly a security issue.

Cheers,

Florian

[James Bennett]

It's not really a discussion of whether "we" (this list) want
something removed; how to enforce Django's trademark is purely the
domain of the DSF. The DSF also has the ability to wave its ownership
of the trademark around and hire lawyers in cases where people are
reluctant to take something down, which has happened in the past. So
again I'd say that if people are putting packages up that seem to
conflict with the Django trademark, just notify the DSF board and let
them handle it.

[Florian Apolloner]

Mhm, I expected such an answer when I hit send :) I maybe should have worded it better. While you are right, that ultimately this is an issue for the DSF board I think that most of those issues can be solved by asking authors/etc nicely without having to invoke the thread of trademarks or lawyers. When that fails then we can surely put it forward to the DSF.

[Adam Johnson]

I re-submitted my proposal through the "contact the foundation" form (  https://www.djangoproject.com/contact/foundation/ ) since that is the only way I know of contacting the board.

--

You received this message because you are subscribed to the Google Groups "Django developers (Contributions to Django itself)" group.
To unsubscribe from this group and stop receiving emails from it, send an email to django-develop...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/django-developers/dbbb7440-8eea-4d4a-9f3f-85aba577edb1n%40googlegroups.com.

--

Adam