Npm operational incident, 6 Jan 2018

I think it's annoying but also toxic to an ecosystem. You have to name your packages the same way you look for a domain name, people can squat on names, and it causes drama like how the 'kik' package was stolen from a developer and given to a company who never used it.

Nobody would've cared it the package was "tzs/kik". For example, the Elm package system does this right.

Another example of this failure is the Reddit subreddit system where a subreddit like /r/bitcoin makes it seem like the authority when it's a carefully moderated and biased subreddit. And nobody can really compete with it without getting a worse subreddit name like truebitcoin and bitcoin2 or something. Would be much more clear if it was /r/@theymos/bitcoin and /r/@spez/politics.

Older?! Kik’s demographic is far younger than anything.

maybe everyone should wait for the full report before jumping to conclusions?

from what it appears, the reason someone else was allowed to register the same package name was because their database didn't pull in the entries for that package. an error? yes. an issue? yes. but it is not a repeat of the same incidence of left-pad.

i'm not going to pass judgement until i read the full report. i think at the very least, whatever mechanism they were using to copy/backup the database seems to have an issue with deleting entries and needs to be addressed

>Namespaced packages/repos have their own problems (figuring out which is the "good" one after some time and a few forks happen)

Most if not all of these packages are hosted somewhere like Github. It's not hard to tell which repo has the most stars, fewest issues or most recent commit, that work's already done for you.

But, we're talking about Node packages here - many of which seem to be trivial, or single line functions. How many forks of left-pad could one expect to find?

Others may be interested to note this blog post from about a week ago by the CTO relating to npm's outage handling [0]. I'm not sure if I would classify this as an outage, but this seems to be the official narrative [1]. Given that status page was updated relatively quickly, I'm guessing that at least something like this procedure kicked in.

I am a little shocked at the brevity of the procedure. I am guessing by the blog post pointing out the brevity that I am meant to be shocked, but if I turned out that 310 word procedure for downtime I'd be pretty confident it was not good enough. I'm not confident that I would be able to read that document and understand what to do if I was the one on pager duty. Maybe it would be different if I worked there and perhaps the procedures are more granular and each of the stages well explained in other procedures. Maybe.

I'm finding it hard to understand what npm does that is so different to other languages' package managers that it can have so many problems and such bad public relations. Linux distros have repositories that handle packages with far greater sizes and quite a few are purely voluntary efforts. They also manage to include package signing as well. I've known of a few hiccups, but none that been handled quite so bad as to completely undermine my trust in the tool altogether.

Is there any compelling technical reason why we couldn't have a tool that works more like go get for node? For those that haven't used it, you just point it at a git repository.

[0] http://ceejbot.tumblr.com/post/169045932039/how-to-handle-an...

[1] https://status.npmjs.org/incidents/41zfb8qpvrdj