Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NPM Is Joining GitHub

github.blog

Post reply on HN
Print view View original

121–130 of 588 posts

Re: NPM Is Joining GitHub

#121

Post by adamc »

reaperducer wrote: post #108
fredsted wrote: post #83

Earlier quoted context omitted.

Embrace, extend, extinguish?

My prediction, that my IT department hates to hear, is that Windows is going away. Microsoft doesn't want to be Microsoft anymore; it wants to be Oracle and IBM and primarily make money off of business consulting and the cloud. I think Windows will eventually become a presentation and slowly-phased-out compatibility layer on top of Linux, similar to the way macOS became Unix, but even less different than its underlyi…

Very unlikely, as it would mess with backwards compatibility and cause unhappiness of users and IT departments. Microsoft still makes money selling Office and other products there.

Re: NPM Is Joining GitHub

#122

Post by dpacmittal »

ThrowawayR2 wrote: post #115
duxup wrote: post #45

Earlier quoted context omitted.

My understanding was that financially they were not going to last long doing what they were doing.

That raises the question of how GitHub/Microsoft plan to profit off the acquisition though? It can't be just for goodwill or marketing.

They own the ecosystem, they can leverage it in a lot of ways. And cost of running npm is drop in the ocean for a giant like MS.

Re: NPM Is Joining GitHub

#124

Post by mceachen »

clarkbw wrote: post #11
dubcanada wrote: post #5

Wait, so is it joining Microsoft? Or is it under Github, which is under Microsoft? I don't fully understand the way it's governed from this article.

Part of GitHub (I work at GitHub and lead the Packages team)

Can I be so bold as to suggest a new feature?

It'd be wonderful, as a package consumer, to have visibility into some security metrics for a given package. This would be useful both at initial install time, and when the package is upgraded. Something like:

1) who are the latest commits GPG signed by?

2) is the package publisher using 2FA?

3) what is the security profile of all dependent packages?

4) are there any new authors (directly or via dependencies) since the last version (with links to the author and their contributions).

These might help avoid prior situations where popular packages get injected with malware by new maintainers.

Re: NPM Is Joining GitHub

#125

Post by sneak »

K0nserv wrote: post #14

This seems like a good outcome overall. NPM being such an important pillar in the software supply chain while having an unviable business model and largely being funded by VC money was never a good position to be in. There are problems with more of the software ecosystem consolidating with a single entity but it still feels like an improvement.

I do not consider the largest distributor of proprietary, closed-source spyware (Windows) owning the fastest growing open source package manager to be a good outcome, personally.

Re: NPM Is Joining GitHub

#126

Post by csours »

clarkbw wrote: post #11
dubcanada wrote: post #5

Wait, so is it joining Microsoft? Or is it under Github, which is under Microsoft? I don't fully understand the way it's governed from this article.

Part of GitHub (I work at GitHub and lead the Packages team)

Slightly OT: Is Packages coming to Azure DevOps Server (local/corporate hosted)?

Re: NPM Is Joining GitHub

#127

Post by sneak »

ChristianBundy wrote: post #109
davnicwil wrote: post #94

Earlier quoted context omitted.

Yes, indeed - and the dependency is literally right there on the technical level. For years, you've been able to specify a version of a package as a github repo's branch HEAD. npm i some-package username/repo#branchName

Bonus points: npm install username/repo#semver:^1.2.3 The big problem is that lots of Node.js modules don't push their tags, so there are issues on lots of repos begging maintainers to push their Git tags so that we don't have to use the npm registry. JavaScript is an interpreted language -- as long as you're only downloading source code from the registry there's really no reason to use a registry instead of the plai…

There is a build/transpilation step.

Re: NPM Is Joining GitHub

#129

Post by lioeters »

ChristianBundy wrote: post #109
davnicwil wrote: post #94

Earlier quoted context omitted.

Yes, indeed - and the dependency is literally right there on the technical level. For years, you've been able to specify a version of a package as a github repo's branch HEAD. npm i some-package username/repo#branchName

Bonus points: npm install username/repo#semver:^1.2.3 The big problem is that lots of Node.js modules don't push their tags, so there are issues on lots of repos begging maintainers to push their Git tags so that we don't have to use the npm registry. JavaScript is an interpreted language -- as long as you're only downloading source code from the registry there's really no reason to use a registry instead of the plai…

A common issue I've had with using Git repos directly as Node.js modules, is that many projects are transpiled/built before publishing to NPM. Depending on specifics of that build process, it may not work out of the box (or at all) from a node_modules folder.

With NPM acquired by GitHub, I can imagine them "filling in some steps" by leveraging the fairly new Actions feature, so that repos can provide built artifacts, the same ones as published on NPM. The deeper integration will be an interesting development to watch.

Re: NPM Is Joining GitHub

#130

Post by efdee »

svnpenn wrote: post #120
banachtarski wrote: post #48

Earlier quoted context omitted.

I installed Windows Subsystem for Linux 2 on an older machine just now. The MSFT of today is definitely a far cry from the MSFT of yesteryear. Such a thing would have been unheard of 15 years ago.

Um, no you didn't. It only works with windows 10 https://docs.microsoft.com/en-us/windows/wsl/wsl2-install

Windows 10 runs on older machines just fine.
Post reply on HN