Live data from Hacker News

NPM Is Joining GitHub

github.blog

391–400 of 588 posts

Re: NPM Is Joining GitHub

#391
post #381

Earlier quoted context omitted.

Care to explain? Safari has one of the highest standards compliance of any modern browser [0], which IE famously did not. It has been argued with various success [1] that Chrome is the new I.E., due to "Chrome exclusive" web standards. [0]: https://html5test.com/compare/browser/safari-11.2/chrome-30/... [1]: https://news.ycombinator.com/item?id=16070595

Want to try something fun? Install any browser in iOS and do a test. Then do the same test with Safari. Now ponder why they are exactly the same no matter which browser you install.

If you're referencing Apple's mandate that WebKit be used as the engine for all iOS web rendering, then yes, that's a poor policy ostensibly made in the name of security. Not sure if that's what your point is, though.

Re: NPM Is Joining GitHub

#392
post #377
post #277

Earlier quoted context omitted.

For programming languages, there are several examples of commercially run package managers: - the Java/Kotlin/Scala ecosystem is based around maven central, which is run by Sonatype, Inc. - Go modules are hosted by Google. Previously, most libraries were hosted on Github - Rust's crate index is on Github - The Docker/Moby registry is run by Docker, Inc. (though that might be a stretch for "package manager" :))

> Rust's crate index is on Github Note that the crates.io index is just a single git repo that holds JSON metadata about each crate: https://github.com/rust-lang/crates.io-index . The actual code found on crates.io is hosted on S3. The index is an important part of the system, but there's nothing tying it to Github specifically.

Who's funding the S3 bill? Took a peek around crates.io but didn't see anything about it.

Re: NPM Is Joining GitHub

#393
post #356
post #239

Earlier quoted context omitted.

I think the honest truth is that a lot of developers see Safari similarly to IE because Firefox and Chrome are quick to jump on and ship new features and "if only Safari kept up" they could be used "everywhere". Combined with the fact that iOS is large enough that you can't just drop Safari support and tell them to use Chrome. It's a weird world where webdevs apparently ideally just want everyone on the 6 second old…

You're right, IE6 was amazing at the time. It made a ton of things possible that previously hadn't been, and the standards bodies were lagging behind it. Had MS actually kept updating IE6 and kept it ahead of the standards, the standards would never have mattered, and we'd never have developed this sick taste for IE. No one hated that they had a monopoly, we hated that they had a stagnant monopoly.

Those of us that were using non-MS OSes like Linux or FreeBSD or Solaris back then hated it that sites were made to work correctly only on IE.

Re: NPM Is Joining GitHub

#394
post #256

Earlier quoted context omitted.

> Tbf Microsoft have won back a lot of good faith with developers due to projects like VS Code and TypeScript, even for those of us who remember their past. Those are great until they're not. It's why it's called "bait and switch". > And we're yet to hear of any negative impact of their Github acquisition (afaik - correct me if wrong). ANY ?! Heh, do a quick search just on HN and you'll find it pretty quickly.

I did search, didn't find it quickly. Could you share some sources of the negative impact? (I'm legitimately curious as my use of GitHub hasn't led me to notice any change.)

I found two pretty damn quickly. They're 3 of the top 5 most upvoted comments on the announcement thread...

https://news.ycombinator.com/item?id=17221640

https://news.ycombinator.com/item?id=17221656

> I'm legitimately curious as my use of GitHub hasn't led me to notice any change

Nor I. That's not that point.

For the record, I think Microsoft has done wonderfully for the dev community in the last 10 years. I don't see any reason that they are going to "f it up", but big businesses get desperate when environments change and profits get impacted (look no further than what Oracle is doing). Microsoft is not immune to that.

Re: NPM Is Joining GitHub

#395

Earlier quoted context omitted.

> after we saw what happened to yarn I missed something, what happened to Yarn?

The maintainer released Yarn 2. Yarn 2 is pretty foundationaly different than Yarn 1, and can and does break a lot of products/projects if used. Some folks are not happy about it, although Yarn 1 will probably continue to be maintained by the community for a while. This seems to be pretty fair about the whole thing: https://shift.infinite.red/yarn-1-vs-yarn-2-vs-npm-a69ccf022...

What happened to yarn is they released a v2 with some backwards incompatibilities... and for this reason we should be glad facebook didn't buy npm? (Also facebook doesn't actually own yarn). Well I'm confused.

Re: NPM Is Joining GitHub

#396
post #291

Microsoftie here — throwaway for obvious reasons. Microsoft doesn’t do everything right but the GitHub acquisition has honestly gone better than I ever expected. Rather than forcing GitHub to adopt Microsoft centric policies, Microsoft has adopted more GitHub stuff, especially from a product POV. GitHub still runs as a separate company (different logins and health care and hiring systems) with its own policies and po…

> Google and Amazon have the EEE under lock right now what is EEE?

You know what they say ... there is no I in EEE.

Re: NPM Is Joining GitHub

#397

Earlier quoted context omitted.

It depends on what the alternative is. When NPM starts running out of money to run the service what would happen? More VC, but only to a point and the firms would be increasingly be influencing NPM to make money by any means(probably not good for anyone but the firms). Alternatively a cash strapped NPM fails to invest in security and availability of the service leading to widespread outages or worse a large scale sup…

Change my mind: package management infrastructure run by government as a public service should be the ideal end outcome for everyone. Why I think this: private or volunteer models are unsustainable in the long run owing to funding uncertainties or conflicts of interest between stakeholders. Utilities that support the bulk of our technical infrastructure should be secured by public interests. Governments can keep thin…

I like Linux's decentralized approach.

That would work for Npm. Npm has enough problems that its worth running your own mirror for business continuity.

Microsoft are likely to make breaking changes immediatly.

Re: NPM Is Joining GitHub

#398
post #377

Earlier quoted context omitted.

> Rust's crate index is on Github Note that the crates.io index is just a single git repo that holds JSON metadata about each crate: https://github.com/rust-lang/crates.io-index . The actual code found on crates.io is hosted on S3. The index is an important part of the system, but there's nothing tying it to Github specifically.

Who's funding the S3 bill? Took a peek around crates.io but didn't see anything about it.

Amazon is! https://aws.amazon.com/jp/blogs/opensource/aws-sponsorship-o...

Re: NPM Is Joining GitHub

#399

Earlier quoted context omitted.

Confused why you think a service servings millions or billions of requests a day wouldn't require money to run. Do you think some grant magically appear out of thin air to pay for the servers, storage, bandwidth, and maintenance?

Big leap from "servers cost money" to "a package manager requires a commercial entity". How are other language ecosystems and package managers operating, many without private companies attached, when they too are serving millions of requests a day?

Which package manager has the scale of JS and isn't hosted by a commercial entity?

Re: NPM Is Joining GitHub

#400
post #277
post #252

Earlier quoted context omitted.

> NPM being such an important pillar in the software supply chain while having an unviable business model and largely being funded by VC money was never a good position to be in. Why does NPM need to be funded as a commercial entity at all? What other open source library has a private company running its package manager? This one still boggles my mind.

For programming languages, there are several examples of commercially run package managers: - the Java/Kotlin/Scala ecosystem is based around maven central, which is run by Sonatype, Inc. - Go modules are hosted by Google. Previously, most libraries were hosted on Github - Rust's crate index is on Github - The Docker/Moby registry is run by Docker, Inc. (though that might be a stretch for "package manager" :))

crates.io is not a commercial enterprise.
Post reply on HN