Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NPM Is Joining GitHub

github.blog

Post reply on HN
Print view View original

141–150 of 588 posts

Re: NPM Is Joining GitHub

#141

Post by bdcravens »

Supermancho wrote: post #136
sneak wrote: post #125

Earlier quoted context omitted.

I do not consider the largest distributor of proprietary, closed-source spyware (Windows) owning the fastest growing open source package manager to be a good outcome, personally.

You aren't the only one. Most users are too young to understand how predatory Microsoft has always been. Can't wait for the "npm won't publish my package because it circumvents something in Windows" or whatever. Give it time.

I am old enough (42) to remember those days, but honestly I don't feel that threatened by them. I remember their EEE days, and for a long time I haven't seen much of the same behavior.

Re: NPM Is Joining GitHub

#142

Post by phoe-krk »

adamc wrote: post #121
reaperducer wrote: post #108

Earlier quoted context omitted.

My prediction, that my IT department hates to hear, is that Windows is going away. Microsoft doesn't want to be Microsoft anymore; it wants to be Oracle and IBM and primarily make money off of business consulting and the cloud. I think Windows will eventually become a presentation and slowly-phased-out compatibility layer on top of Linux, similar to the way macOS became Unix, but even less different than its underlyi…

Very unlikely, as it would mess with backwards compatibility and cause unhappiness of users and IT departments. Microsoft still makes money selling Office and other products there.

Microsoft doesn't need to care about backwards compatibility anymore, now that Wine exists precisely to have compatibility with Windows software (including software that even modern Windows itself no longer wants to run).

Re: NPM Is Joining GitHub

#143

Post by sbarre »

BiteCode_dev wrote: post #96
batmansmk wrote: post #7

VsCode, Typescript, Github, NPM. And Microsoft doesn't even have to maintain the main runtime, Google does. What a clever strategy!

Yes, they almost own the entire JS ecosystem at this point. They lost a decade of battles for the web, but it seems they just found a way to get back in the fight. Now at the IE 6 times, that meant monopoly, and it was terrible news. But today, it means more competition between the giants, which is very good for us.

One could argue that the IE6 of our times is Google Chrome at this point..

Re: NPM Is Joining GitHub

#144

Post by allover »

Supermancho wrote: post #136
sneak wrote: post #125

Earlier quoted context omitted.

I do not consider the largest distributor of proprietary, closed-source spyware (Windows) owning the fastest growing open source package manager to be a good outcome, personally.

You aren't the only one. Most users are too young to understand how predatory Microsoft has always been. Can't wait for the "npm won't publish my package because it circumvents something in Windows" or whatever. Give it time.

Tbf Microsoft have won back a lot of good faith with developers due to projects like VS Code and TypeScript, even for those of us who remember their past.

And we're yet to hear of any negative impact of their Github acquisition (afaik - correct me if wrong).

Re: NPM Is Joining GitHub

#145

Post by clarkbw »

mceachen wrote: post #124
clarkbw wrote: post #11

Earlier quoted context omitted.

Part of GitHub (I work at GitHub and lead the Packages team)

Can I be so bold as to suggest a new feature? It'd be wonderful, as a package consumer, to have visibility into some security metrics for a given package. This would be useful both at initial install time, and when the package is upgraded. Something like: 1) who are the latest commits GPG signed by? 2) is the package publisher using 2FA? 3) what is the security profile of all dependent packages? 4) are there any new…

Yes, we (internally) call this a "Bill of Health" and believe that all packages should have this kind of diff-able information available. Understanding what's happening at the source level is key to being able to trust any package published.

Re: NPM Is Joining GitHub

#146

Post by sneak »

bdcravens wrote: post #137
sneak wrote: post #125

Earlier quoted context omitted.

I do not consider the largest distributor of proprietary, closed-source spyware (Windows) owning the fastest growing open source package manager to be a good outcome, personally.

Then you must not like React or Angular, since the owners of those projects are the largest spyware and aggregators of personal data in the history of humanity.

Software and services are not the same thing.

For some examples: RMS being a douchebag has nothing to do with the usefulness of gdb, nor can that circumstance affect the utility in any imaginable scenario.

Microsoft setting censorship policies (aka ToS) on a website they own and control directly affects the utility of npm/yarn/clients. Their website, their rules.

Re: NPM Is Joining GitHub

#147

Post by nojvek »

Github announced the Github packages feature a while back, but without npm it didn't quite make sense. Acquiring npm means github not only hosts source code, but packages as well. With Github Actions, they want to be the one stop shop for code lifecycle and be at the forefront of javascript ecosystem.

If developers love Github, they love the cloud. Microsoft is betting big on the cloud, they lost the Mobile war but they definitely want to be the developer and cloud darlings.

Re: NPM Is Joining GitHub

#149

Post by bromuro »

bdcravens wrote: post #141
Supermancho wrote: post #136

Earlier quoted context omitted.

You aren't the only one. Most users are too young to understand how predatory Microsoft has always been. Can't wait for the "npm won't publish my package because it circumvents something in Windows" or whatever. Give it time.

I am old enough (42) to remember those days, but honestly I don't feel that threatened by them. I remember their EEE days, and for a long time I haven't seen much of the same behavior.

Same here (40). I was with Ballmer singing “developer developer developer”... i think his legacy is not that bad. The company was not ready to grasp the idea of open source at these times, but the principle holds.

Re: NPM Is Joining GitHub

#150

Post by flanbiscuit »

I wonder if more people will look into adopting Deno[1], the new node alternative by one of the creators of Node. It does not use NPM, you pull in packages Go-style (via URLs[2]). It's supposed to be more secure because you have to explicitly give it access to anything (i.e. network, file system, etc).

[1] https://deno.land/

[2] example import in Deno:

    import { serve } from "https://deno.land/std@v0.36.0/http/server.ts";
Previous HN about Deno: https://news.ycombinator.com/item?id=22102656
Post reply on HN