21–30 of 69 posts
I am wondering, without having much knowledge about it, could a system like Ubuntu's package manager & registry (or any other Linux's distro) be suitable for JS?
I don't believe yet another package manager is going to fix anything, more likely it'll take years to reach maturity, will be riddled with bugs until then, and have some serious fundamental issues on its own that will be revealed down the path, if it ever gains popularity. Don't fix it if it aint broke should be a motto for more developers. Settling for good enough prevents second system effects and retards immaturit…
npm is broke, though. Better to have a replacement ready for when they finally go bang under the pressure of venture capitalism.
Earlier quoted context omitted.
That's a fault of npm - _the registry_'s policies, not of the package manager. You could do the same with most other popular package managers if you have control over the registry.
Sounds like you're agreeing with the Entropic people: https://twitter.com/bitandbang/status/1134872073896169472 Their approach is to create a different kind of registries, and inevitably they need a new client that supports them.
I'm not quite convinced by their federated approach though. It feels like its just spreading out the problems, and not really preventing them from happening, and in the worst case even creating new ones.
As pointed out in the talk, running a registry becomes expensive once it becomes popular. So now instead of 1 central registry (which I agree is not a good idea) needing to fund the hosting, you have maybe 10-100 federated registries, with each one of them needing to fund the hosting and coming up with different economic models around it.
I'm also not sure how they would really be able to ensure immutability of packages in a federated system. A node could simply publish two different packages with the same name and version number to different parts of the network. Yes, you can reduce the impact by saving an integrity hash in a lockfile, but npm already does that today.
The thing I don't get, is, I'm using Git repos as source for my packages for years now, why can't everyone do this?
Or you can tie it to Github and then download a release from their CDN.
I am wondering, without having much knowledge about it, could a system like Ubuntu's package manager & registry (or any other Linux's distro) be suitable for JS?
Of course. APT is used to install JS libraries already but people prefer the npm because it gives people enough freedom [to make the ecosystem a complete mess].
Earlier quoted context omitted.
Of course. APT is used to install JS libraries already but people prefer the npm because it gives people enough freedom [to make the ecosystem a complete mess].
Can you please explain how APT limits freedom?
If I visit their website without the www ( http://entropic.dev ), I get some curious JSON: {"server":"entropic","version":"0.0.1","message":"GCU Fate Amenable To Change","website":" https://www.entropic.dev" } Anyone know the significance of "GCU Fate Amenable To Change" ? I did Google it, but that didn't help much.
It's a reference to Iain Banks' culture universe - it's the name of one of the (sentient) ships.
The thing I don't get, is, I'm using Git repos as source for my packages for years now, why can't everyone do this?
The thing I don't get, is, I'm using Git repos as source for my packages for years now, why can't everyone do this?
Not everyone tags releases so you're stuck if you need a fixed version of a dependency. Or you can tie it to Github and then download a release from their CDN.
Example:
"dependencies": { "myprivatemodule": "git+ssh://git@github.com:user/project.git#commit-hash" }
If npm stops being the go-to solution, another one will take its place, naturaly adopted by the community, following the path of least resistance. Centralized or not. It does not really matter. What does matter is the code that's being downloaded. Modules dependencies management is an old problem, countless of tools have tackled.
Is the node and front projects architectures that dependent on npm ? It's a little coupled but not that coupled ? The dependency management still require a little brain power from dev teams, or does it really fully relie on the package managers ?