Live data from Hacker News

NPM Is Joining GitHub

github.blog

411–420 of 588 posts

Re: NPM Is Joining GitHub

#411
post #260
post #167

Earlier quoted context omitted.

That must make you nervous over at GitLab, no? GitLab's integrated workflow is one of its main selling points (I love it), and GitHub now seems to be well underway to cross that moat.

It is exciting to see that having everything in a single application is being validated by GitHub. Last year it was very clear they are switching from a marketplace model to a single application by including Verify (CI), Package, and Secure. We think Git(Lab|Hub) will become the two most popular solutions and we look forward to this competition https://about.gitlab.com/handbook/leadership/biggest-risks/#... I think t…

> It is exciting to see that having everything in a single application is being validated by GitHub

I wish Gitlab would get over this passive-aggressive negging of GitHub.

I would squirm seeing something like that among any two competing companies. But it takes a strange configuration of overcompensating an inferiority complex to use it for the specific case of one company starting out as an explicit clone of another, to then lord any small feature the original company may have followed over them.

This isn't the first time. I've seen it dozens of times, and I don't even specifically care about these two companies.

Re: NPM Is Joining GitHub

#412
Microsoft have been making their code analysis tools available in GitHub post-aquisition; doing the same for npm could really help improve the risks JS programmers face when pulling in libraries from npm.

Re: NPM Is Joining GitHub

#413
post #394

Earlier quoted context omitted.

I did search, didn't find it quickly. Could you share some sources of the negative impact? (I'm legitimately curious as my use of GitHub hasn't led me to notice any change.)

I found two pretty damn quickly. They're 3 of the top 5 most upvoted comments on the announcement thread... https://news.ycombinator.com/item?id=17221640 https://news.ycombinator.com/item?id=17221656 > I'm legitimately curious as my use of GitHub hasn't led me to notice any change Nor I. That's not that point. For the record, I think Microsoft has done wonderfully for the dev community in the last 10 years. I don't s…

Neither of those show negative impact but people worried about potential future negative impact.

Re: NPM Is Joining GitHub

#414
post #14

This seems like a good outcome overall. NPM being such an important pillar in the software supply chain while having an unviable business model and largely being funded by VC money was never a good position to be in. There are problems with more of the software ecosystem consolidating with a single entity but it still feels like an improvement.

I'd really love to teleport some forum nerd from just six years ago to the present.

- Microsoft is a leading sponsor of open source?

- In fact, .NET is open source now and runs on Linux?

- Microsoft bought Github, then NPM... and the community is celebrating both of those things??

- The guy from the apprentice is what?

Re: NPM Is Joining GitHub

#415

Earlier quoted context omitted.

Yeah, and the PSF is worried that the possible cancellation of PyCon could send the whole foundation broke. The fact that there's a bunch of critical infra run on a precarious volunteer shoestring is not a good thing.

Maybe look in your node_modules folder sometime, eh? Or the Linux kernel. The whole world runs their critical infrastructure on volunteer work.

Hmm, not everyone is a volunteer...

Re: NPM Is Joining GitHub

#416

Ok, everyone seems to be beating up on Microsoft per the top comment here. I have a counter point - Does anyone ever think what would happen if Microsoft were to disappear tomorrow? How would you get your drivers license? How would you process your mortgage? How would you go about buying tickets for anything? How would you get your groceries and food? Are we expecting everyone to run Linux? Or shall we say, Ubuntu? O…

It's not a very good counterpoint is it? Insulting, patronising, talking down, squashing dreams and ideology and recommending a "give up and lose" course of action.

> There are more important things in life that tabs or spaces, or carriage returns and line feeds.

Things like rights to control the things you own, to know what they are doing, and to understand and repair them. Things like being able to use a device for as long as you choose without it relying on a third-party service which could be shut down any time it becomes unprofitable. Being able to control where your personal information is, and more widely, a population being able to control such; not being a source of information for surveillance capitalism - or having some chance of opting out without using a closed black box system.

> People pay for things that will work together seamlessly, that takes the least effort to work with.

Seems like a good reason to push for open standards instead of proprietary protocols, proprietary encryption and authentication schemes, proprietary connectors, and warranties that void if you look at them wrongly. As the "internet of things" grows, do we want to be building a population which picks which nanny-corp handles their doorbell, smoke alarm, intruder alarm, CO2 detector, and lighting system - you get Apple, Nest, Google, Philips, Amazon, Logitech, Sony .. but whichever you choose they will all send your life to an unsecured MongoDB in the cloud, and won't interoperate with each other to lock you in to a platform.

A decade (or two?) ago there was a guy who put sensors all over his neighbour's house and wrote software to stalk them, predicting when they were in or out, who was home, and watching them. He was arrested. Now that's de rigueur and you don't know who is, or can, access your data.

> I think it's time we admitted to ourselves, that we can't decide on anything collectively

But we are better off disagreeing about JSON and TOML and YAML instead of being unaware and unable to disagree about Google encrypted binary config blob, Microsoft encrypted binary config blob, Amazon encrypted binary config blob, Apple encrypted ... etc.

> We'll all die soon and everyone will be paying for software as a service

This is what capitalism wants. That doesn't mean it's what we should accept.

> Stop being so self-centered and churlish.

Who is it here advocating "as long as it works for me and I get paid, that's the most important thing"? How self-centered is that as an attitude?

> Get a good night's sleep.

Track your good night's sleep on a FitBit, upload it to Amazon, have it tied to your speculative future purchases predictions, maybe have it resold to your health insurance provider why not. What could go wrong.

Re: NPM Is Joining GitHub

#417
What I'd hope : Somehow make packages more secure than hoping that nothing is tainted in the dependency. I think this is the biggest issue of volunteer package repo.

What I'd not hope : MS changes strategy with change of people etc and npm and GitHub rot.

Re: NPM Is Joining GitHub

#418
post #398

Earlier quoted context omitted.

Who's funding the S3 bill? Took a peek around crates.io but didn't see anything about it.

Amazon is! https://aws.amazon.com/jp/blogs/opensource/aws-sponsorship-o...

Ah, neat! Works out well for them; I assume it's relatively cheap to just serve an S3 bucket on their CDN (though I guess bandwidth costs may rise rather dramatically if Rust ever reaches Node levels of popularity), while not taking on any other operational expenses of actually running a registry.

Re: NPM Is Joining GitHub

#419
post #180

Earlier quoted context omitted.

Tbf Microsoft have won back a lot of good faith with developers due to projects like VS Code and TypeScript, even for those of us who remember their past. And we're yet to hear of any negative impact of their Github acquisition (afaik - correct me if wrong).

VS Code is also spyware; I am not sure that this argument furthers your intended point. The fact that it is open source and popular is not sufficient on its own. It had to be forked (vscodium) to show basic respect for the user’s privacy and system resources.

> VS Code is also spyware

This is such an extreme & pretentious viewpoint. Microsoft knowing that I have VS Code installed & getting a report when it crashes is not in mine, or really any normal developer's threat landscape.

Re: NPM Is Joining GitHub

#420

Earlier quoted context omitted.

The maintainer released Yarn 2. Yarn 2 is pretty foundationaly different than Yarn 1, and can and does break a lot of products/projects if used. Some folks are not happy about it, although Yarn 1 will probably continue to be maintained by the community for a while. This seems to be pretty fair about the whole thing: https://shift.infinite.red/yarn-1-vs-yarn-2-vs-npm-a69ccf022...

What happened to yarn is they released a v2 with some backwards incompatibilities... and for this reason we should be glad facebook didn't buy npm? (Also facebook doesn't actually own yarn). Well I'm confused.

I'm not OP, but I the inference I draw from the comment is that with Yarn declining in quality the probability is higher than NPM will once again become the de-facto standard, thus, it is ideal that any company responsible for its stewardship serve not as further consolidation of power in the industry (which currently leans Alphabet/Facebook).

IMO its crazy we're here, growing up in the IE days, but Microsoft acquiring influence over the JS ecosystem in this day and age is at least arguably, as OP stated, a distribution of power.

Post reply on HN