jslicense / licensee.js

check dependency licenses against rules
https://www.npmjs.com/package/licensee
Apache License 2.0
185 stars 23 forks source link

Use "allowlist" and "blocklist" rather than "whitelist" #72

Closed bnb closed 3 years ago

bnb commented 3 years ago

The terminology "whitelist" and "blacklist" are used in a way that mean "good, blessed, permitted, positive" and "bad, forsaken, forbidden, negative" respectively. These are problematic in our society for reasons that are relatively obvious.

Instead, it would be preferable to use "allowlist" and "blocklist" or "allowlist" and "denylist" where the terminology is present.

I'm happy to submit a PR to make changes where relevant. I wanted to get a +1 from the maintainers via an Issue first, however, so as not to be particularly intrusive with a PR that is focusing on a negative.

If the use of spdx-whitelist is a blocker, I'm also happy to help do work there and in its upstream dependencies to update its terminology or help rename and republish it to spdx-allowlist or whatever other terminology that is preferred.

References on others doing this same thing/discussing the subject:

ljharb commented 3 years ago

Renaming the dep seems the only thing that's particularly onerous; everything else can be done in a semver-minor or semver-patch way. I'm on board, even if it's for "everything but renaming the package".

@kemitchell?

kemitchell commented 3 years ago

I have very little bandwidth ATM. @ljharb do you have perms to get this done?

ljharb commented 3 years ago

I'm pretty sure I have merge perms everywhere needed, at least - if you're ok with it, I'll let @bnb put up the PRs, and I'll get them landed, and then if at that point I'm missing any permissions, I'll ping you here?

(hope you recover soon!)

bnb commented 3 years ago

Hope you feel better soon @kemitchell ❤️

@ljharb I'll get a PR up this week.

bnb commented 3 years ago

closing since https://github.com/jslicense/licensee.js/pull/73 was merged :)