51–60 of 78 posts
It's easy to complain, it's more difficult to work on solutions. We should all be doing more of the latter (working on solutions).
We have IPFS and the code for hosting most registries is open-source. If the opensource community really wanted to / got annoyed enough, it would devise a system that used those components to make a distributed package registry. It's easy to complain, it's more difficult to work on solutions. We should all be doing more of the latter (working on solutions).
This article ignores the fact that for many languages, the package repository is maintained as free software by volunteers (sometimes with funding from a foundation). This includes Perl, Python, Ruby, Rust, and many others. NPM is the odd one out, really. I don't think letting one company control a language ecosystem's single package registry is a great idea, for all the reasons that the author notes!
I agree, though it's worth noting that while volunteers can maintain the software and administer the indexes, they also rely on infrastructure provided by big corporations. E.g. the Python Package Index runs on a CDN provided by fastly, which serves hundreds of TB per day. I very much doubt the non-profit Python Software Foundation could afford that bandwidth if it wasn't an in-kind donation.
"If you don't support us, we might accidentally forget to audit our packages and feed malware into your build pipelines. It'd truly be a shame..."
Earlier quoted context omitted.
It's more akin to making and then running a CDN but only charging 10% of customers. I'm sure Docker the company was writing it off as a marketing expense, but if they were running this in one of the public clouds that charge for egress, they were paying out a boatload of money just in egress charges (plus more in storage costs)
making and then running a CDN but only charging 10% of customers Like CloudFlare? Freemium can be a very successful business model.
Maybe a content-addressable P2P web where everyone has their own cache would be better as a way of distributing packages. It would spare a lot of bandwidth costs for the hosts and maybe make us less dependant on big corporate benefactors.
One objection that I'm sure will come up is "what if people stop hosting a package you depend on":
That's where dedicated package hosting services (like npm) can come in and provide a reliable source of these packages that's fast and always available (potentially for a price). The benefit over the status quo is those services will be commoditized, so they have to compete purely on price/reliability, since as a user you don't have to care where the packages come from in a content-addressed system.
Earlier quoted context omitted.
It's more akin to making and then running a CDN but only charging 10% of customers. I'm sure Docker the company was writing it off as a marketing expense, but if they were running this in one of the public clouds that charge for egress, they were paying out a boatload of money just in egress charges (plus more in storage costs)
making and then running a CDN but only charging 10% of customers Like CloudFlare? Freemium can be a very successful business model.
This is an important conversation and I can't help but think that it is repeatedly drawn in predictably valley-minded directions. As a responsible developer your use case is likely: "I want to install package X, and know that my customers are receiving and installing that package when they perform a build" The fact that individuals cannot self-host content has been held back by the limitations of DNS (content address…
Earlier quoted context omitted.
There are tools for doing this, but it's a matter of cost and complexity to deal with them. Artifactory seems to have a pretty big chunk of this vertical. It supports a few different repository protocols, so it serves as a bit of a one-stop shop that survives technology changes.
If you are fetching multiple GB of images over the network it kinda make sense.
Even ignoring download costs, a local cache (one of the functions of an artifactory) helps speed up those downloads and,with it, your builds. It probably also helps against getting blacklisted by code repositories.
An artifactory also automatically backs up any libraries you use. That protects against them disappearing from the internet.
This is an important conversation and I can't help but think that it is repeatedly drawn in predictably valley-minded directions. As a responsible developer your use case is likely: "I want to install package X, and know that my customers are receiving and installing that package when they perform a build" The fact that individuals cannot self-host content has been held back by the limitations of DNS (content address…
How can we not self-host? For lots of these you can if you want. I mean, I host docker images and various packages that folks source from our infrastructure. I don't see DNS or IPv4 as a blocker
Hell I don't know how I would self-host, I just (reluctantly) put stuff on paid-for servers. I guess you start by calling your ISP and asking if they can pretty please give you a static IPV4?
Earlier quoted context omitted.
I was amazed anyone tried to make a free Docker registry. It's like making a CDN, except instead of individual files, it's for a whole app and all of its dependencies. It's a crazy amount of data for storage and bandwidth.
Well of course you've got to do that in the first place to get people to sign up to the docker model and become dependent on registries in the first place.
Now that they have it, the cost they are willing to pay is based in part on cost-of-switching. Which is pretty enormous, directly and indirectly, when entire ecosystems based on docker have been iterated.