Are Package Registries Holding Open-Source Hostage?

FTA: "Ultimately, package registries need to align their incentives with those of maintainers."

Putting it all on the registries to come up with a viable business model and provide this to maintainers without any responsibility[1] on the part of the maintainer seems really one-sided.

It costs quite a bit of money to run something like Docker Hub or NPM. If you want something aligned software maintainers first and foremost, you want a non-profit / foundation that's got priorities aligned with the larger community and not a for-profit entity that has to justify keeping the lights on.

Kinda silly headline, too. There are many package registries, but we only see two here that have business models interfering with distribution of software. Only one that's really impeding the ability to host software elsewhere if you don't like their business model.

Docker Hub's rate limits seem unlikely to impact most usage of Docker, and people who're pulling 200 images every six hours should either seek to set up their own registry to take the load off Docker Hub or throw some money to help shoulder the costs. Even if the user's only grabbing Alpine images at 5MB per image, 200 in six hours starts to add up!

[1] Granted maintainers may do a lot of work in actually maintaining the software.

Why is no one talking about this solution?

I use a number of dependencies.

Most, I wrote, myself, maintain on GitHub, and include as Swift Package Manager dependencies. I write in a modular, layered fashion, and try to fork off as many components as possible into standalone projects.

I'm very, very careful about including third-party dependencies. I think that these are the only ones that I use, throughout my projects:

    SOAPEngine (Paid)
    ffmpeg
    VLCLib
    SwiftKeychain

The first, I downloaded and installed directly into my repo (no live link), the two video libs, I use Carthage to include from their home repos, and the last, SPM (also from the home repo). No real registries. I am not a fan of CocoaPods. I use Homebrew for some dev utils on my computer, but the above list is what ships.

I may have one more, somewhere, but I can't remember, and I'm too lazy to look. We can rest assured that it was not lightly added.

This article ignores the fact that for many languages, the package repository is maintained as free software by volunteers (sometimes with funding from a foundation). This includes Perl, Python, Ruby, Rust, and many others.

NPM is the odd one out, really. I don't think letting one company control a language ecosystem's single package registry is a great idea, for all the reasons that the author notes!

I agree, though it's worth noting that while volunteers can maintain the software and administer the indexes, they also rely on infrastructure provided by big corporations. E.g. the Python Package Index runs on a CDN provided by fastly, which serves hundreds of TB per day. I very much doubt the non-profit Python Software Foundation could afford that bandwidth if it wasn't an in-kind donation.