Previous discussion: https://news.ycombinator.com/item?id=20076814 The idea of a federated package registry is good: it tries to avoid centralization and control of a language ecosystem by a private company (like it happened with NPM). However, I think it can easily be gamed, the same way Git was gamed by GitHub. I do wonder what prevents any of the big companies, for example, Microsoft through Github, to host an ins…
IMO the git/github scenario was the least harmful because git is actually decentralized. If github goes down or turns bad, the exodus to a new platform would happen faster than it happened on sourceforge. The SaaS should be walking on eggshells by design—that can only happen with real decentralization at the protocol layer, like git but unlike smtp or xmpp. That way we are just freeloading off whatever cloud company wants to take us before we jump ship.