Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub Package Registry

github.com

Post reply on HN
Print view View original

261–270 of 389 posts

Re: GitHub Package Registry

#261

Post by jermo »

amdelamar wrote: post #120
ccleve wrote: post #31

This is really outstanding. It will mean the death of Maven Central, about which I have mixed feelings. On the one hand, Sonatype deserves enormous thanks for what they have done for the open source world, as does mvnrepository.org. Their central repository has been free and maintained for a long time. Thank you, Sonatype. On the other hand, it took me three days to release a new version of one of my artifacts the ot…

I tried publishing a side-project to Maven Central for a few hours, only to give up and publish to Bintray in minutes. I'm willing to admit I was probably doing it wrong, but I'm glad it forced me to look at other options. There are definitely easier methods of package/publishing out there, and GitHub package registry sounds awesome.

One of the easiest is jitpack.io which builds and publishes to its own Maven repository

Re: GitHub Package Registry

#262

Post by ecocentrik »

yawaramin wrote: post #151
IceSentry wrote: post #147

Earlier quoted context omitted.

Just because Microsoft has a lot of money doesn't mean they can just throw it around. That's not how the world works...

They're literally throwing around money creating new coding tools, languages, buying GitHub, LinkedIn, ... if we were to debate the effectiveness of its spending, there would be a lot to talk about.

I hope you're not serious. Very few companies do anything just for goodwill.

Re: GitHub Package Registry

#263

Post by wst_ »

CamouflagedKiwi wrote: post #246
adambatkin wrote: post #142

Earlier quoted context omitted.

Publishing to Maven Central comes with a bunch of requirements ( https://central.sonatype.org/pages/requirements.html ) may be seen as a burden to packagers, but is certainly a delight for end-users of those packages. All packages are GPG signed, come with companion source and javadoc artifacts, and are guaranteed a certain amount of other metadata in the POM. There are "easier" repositories (like Bintray jcenter) bu…

Unfortunately the GPG signing is worthless because there's no way of attaching trust to each key. So each package has been signed, but anyone could have issued the keys, so an attacker could easily do the same. Also, not all artifacts have sources and javadoc. Most do but some certainly don't.

So continuing this way GPG is worthless in general. Most of the keys you can't verify in person so there is no trust whatsoever. In this case Sonatype is verifying key for you. They will check if your key belongs to you and you are in control of your organization. Otherwise package would not be accepted.

I may be wrong but source and javadoc are requirements. Maybe there are some old packages without it, but new ones should be complete.

Re: GitHub Package Registry

#264

Post by johannes1234321 »

yawaramin wrote: post #151
IceSentry wrote: post #147

Earlier quoted context omitted.

Just because Microsoft has a lot of money doesn't mean they can just throw it around. That's not how the world works...

They're literally throwing around money creating new coding tools, languages, buying GitHub, LinkedIn, ... if we were to debate the effectiveness of its spending, there would be a lot to talk about.

That has long term effects of tying developers to the brand.

Giving money to sonatype or somebody like that will be forgotten in a week by outsiders.

Re: GitHub Package Registry

#266

Post by nkkollaw »

PureParadigm wrote: post #89

I'm worried about the resiliency of code distribution as we continue the trend of centralizing distribution in a few large companies. GitHub has had service outages in the past, so what happens when not just our repositories but also now packages are not accessible the next time that happens? It would be great if they'd implement it using an open/decentralized protocol such as IPFS, so that even if GitHub went down t…

It would be nice to use more companies but I suspect if people ran their own Git instances there would be a lot more outages.

Re: GitHub Package Registry

#267

Post by PeterStuer »

srgpqt wrote: post #154
IceSentry wrote: post #147

Earlier quoted context omitted.

Just because Microsoft has a lot of money doesn't mean they can just throw it around. That's not how the world works...

They bought Minecraft for 4 billion.

2,5 Billion, with money from oversees on which they otherwise would be heavily taxed. They bought a game studio with significant growth potential at 20x its annual profits, but maybe even more important, they bought 54 Million and growing user accounts on a diversity of platforms, of often very young captive users, easily convertible into Microsoft accounts, a number which was poised to expand rapidly.

Indeed, Microsoft has sold and added 100M more Micecraft licenses and accounts since.

From an account acquisition point of view alone, which fairly often is the main driver of these transactions, the deal was a steal. I'd estimate the value of a fresh user account in a desirable demographic to be around $250 for Microsoft. Even the short term projected revenue would be close to $10.

Microsoft projected the deal to pay for itself in 1 year, and while not having followed the case up close, chances are it did.

Re: GitHub Package Registry

#268

Post by Xylakant »

CamouflagedKiwi wrote: post #246
adambatkin wrote: post #142

Earlier quoted context omitted.

Publishing to Maven Central comes with a bunch of requirements ( https://central.sonatype.org/pages/requirements.html ) may be seen as a burden to packagers, but is certainly a delight for end-users of those packages. All packages are GPG signed, come with companion source and javadoc artifacts, and are guaranteed a certain amount of other metadata in the POM. There are "easier" repositories (like Bintray jcenter) bu…

Unfortunately the GPG signing is worthless because there's no way of attaching trust to each key. So each package has been signed, but anyone could have issued the keys, so an attacker could easily do the same. Also, not all artifacts have sources and javadoc. Most do but some certainly don't.

You could for example opt for TOFU. Then at least you’d be protected against a malicious takeover unless the attacker manages to access the maintainers private key. That’s been a pretty common issue in the recent past.

Re: GitHub Package Registry

#269

Post by dtech »

CamouflagedKiwi wrote: post #246
adambatkin wrote: post #142

Earlier quoted context omitted.

Publishing to Maven Central comes with a bunch of requirements ( https://central.sonatype.org/pages/requirements.html ) may be seen as a burden to packagers, but is certainly a delight for end-users of those packages. All packages are GPG signed, come with companion source and javadoc artifacts, and are guaranteed a certain amount of other metadata in the POM. There are "easier" repositories (like Bintray jcenter) bu…

Unfortunately the GPG signing is worthless because there's no way of attaching trust to each key. So each package has been signed, but anyone could have issued the keys, so an attacker could easily do the same. Also, not all artifacts have sources and javadoc. Most do but some certainly don't.

> So each package has been signed, but anyone could have issued the keys, so an attacker could easily do the same.

Not true. The GPG signature means the key belongs to an account with access to the group id (namespace, usually a domain), and that sonatype has verified the group id belongs to the original admin account for that group id.

It's not a lot of guarantees, but you cannot just generate a GPG key, sign a package, and publish to maven central.

Re: GitHub Package Registry

#270

Post by rswail »

ksec wrote: post #242
rectang wrote: post #101

Earlier quoted context omitted.

> MS's core competency has always been developers. As a developer who still has to work very hard to forgive MS for all the pain IE6 put me through a decade ago, this grates on my ears, even though I understand that it might be true in the abstract. Classically, MS has been good to developers who agree to be chained to their platform, but has made life extremely difficult for developers who want or need to be platfor…

>As a developer who still has to work very hard to forgive MS for all the pain IE6 put me through a decade ago, this grates on my ears, even though I understand that it might be true in the abstract. Yes, Active X, Windows, Java etc, and god knows how many awful things they did I cant remember them all. But years later Bill Gate decide to donate his wealth to good cause. Not only is this not a PR / Marketing Stunt, h…

Back in the 80s, IBM was evil, Apple and Microsoft were good. I have an "I HATE IBM" badge from a very early computer show.

MS was mainly known for its languages and its apps, more than the OS. IBM PCs still came with CP/M or PCDOS (MSDOS).

Then when Windows 3 came out, MS started to act like IBM but on steroids, thinking they owned the "stack" (as it was). OS/2 was the last attempt to extract the "PC compatible" world from the Windows domination.

Then IE6 and ActiveX ensconced MS in the enterprise. What used to be "you won't get fired for buying IBM" became "you won't get fired for buying MS because there's no choice".

The onset of the web and competitors in MS's dominant space (well except for apps, Office still rules the world) and the demise of the Ballmer years (especially the death of their mobile/phone ecology) means that MS is now actually doing what IBM did about 15 years ago when they adopted Linux.

To quote Vonnegut, "So it goes".

Post reply on HN