Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub Package Registry

github.com

Post reply on HN
Print view View original

121–130 of 389 posts

Re: GitHub Package Registry

#121

Post by jacques_chester »

paulddraper wrote: post #91
mceachen wrote: post #34

Doesn't this bifurcate the namespace of literally every packaging system they are supporting, or are they requiring `@author/`-namespaced package names? In the livestream he pokes around a github repo, sees it's one author, and decides that what makes it trustworthy? No GPG signing? The new Actions support (about 50 minutes into the live stream) for auto-publishing from master is pretty sweet. From the very cursory d…

> Doesn't this bifurcate the namespace of literally every packaging system they are supporting No. Unless you consider the URL the namespace, but it's not. E.g. I can download the deb "vscode" from https://packages.microsoft.com/repos/vscode Or I could download that it from a GitHub-user controlled URL, or someone's random website. The name of the package is still "vscode", regardless of what location it was fetched…

> No. Unless you consider the URL the namespace, but it's not.

It is for docker images. `foo/bar` is implicitly `hub.docker.com/foo/bar`.

Re: GitHub Package Registry

#123

Post by ne01 »

sambroner wrote: post #17
gigatexal wrote: post #14

This is pretty interesting. Github really is becoming the social network that MS never seemed to be able to create. We already use it as our portfolio of work for potential employers. We collaborate with fellow enthusiasts and maybe even make new friends. We host our websites from it. Abuse it to store binaries, too. And now, along side, source code we can use it as a CDN of sorts to serve packages, for free, sounds…

Good points. I definitely see some people (ab)using Issues as a way to ask fairly generic coding questions. It might be time they open up another avenue for questions generally.

We already do this by adding the tag "Question" to the issue. But you are right a dedicated system for questions is better.

Re: GitHub Package Registry

#124

Post by gberger »

koolba wrote: post #112
flunhat wrote: post #93

Earlier quoted context omitted.

In light of StackOverflow looking for a new CEO, layoffs in the past year and a half, $68 million in venture capital looking for a return, and Joel Spolsky's connections to Microsoft, this might actually happen. I've also gotten the impression that StackOverflow's recruiting product isn't doing so well. It seems to be a few hundred dollars a month for a single job posting, but the results for recruiters are apparentl…

I think they use SQL Server as well so there’s that poster child angle as well.

And C#.

Re: GitHub Package Registry

#125

Post by madeofpalk »

ElijahLynn wrote: post #116
gigatexal wrote: post #90

Earlier quoted context omitted.

The stack at SO is heavy on MS tech too. I believe they run a lot of SQLServer.

Truth, I was at SO in Manhattan for a JS meetup a couple times and all the desktop computers were PCs with Dell monitors.Not a single Mac in sight. Have a feeling they weren't running linux either since Stack Overflow is .NET I believe.

I remember many many years ago listening to the Stack Overflow podcast which was Jeff Atwood and Joel Spolsky talking, in real time, about them creating Stack Overflow.

IIRC it uses ASP.Net MVC or something like that, and might have been the first and/or biggest site using it?

Re: GitHub Package Registry

#126

Post by ne01 »

pornel wrote: post #117

I worry about npm now. The huge public registry everyone loves is run off investor's money and subsidized by npm's private registry product. But npm has recently changed their nice-people-matter CEO to a now-print-money dude, so I suspect investors' patience has run out. And now GitHub went directly after the one thing that npm is supposed to be making money on.

I guess this is the risk of working on a product that could be easily added as a feature to a much more popular product. But, hey, Dropbox is still successful.

Re: GitHub Package Registry

#127

Post by sho_hn »

_bxg1 wrote: post #115

There's something slightly concerning about ceding responsibility for distributing the world's open-source projects from a family of strong independent repositories to a centralized platform owned by a tech giant.

Yes, but that's not a new concern - to some, GitHub has always represented an anathema to what git was supposed to be and bring. Centralization at a proprietary vendor, instead of open systems interacting. Then locking people in further by network effect and adding centralized products around git. That it's become so popular many people equate GitHub with git adds insult to injury.

I completely understand why this all happened (centralization is just so easy and convenient; federation is hard), and it was probably inevitable in its timeframe, but I also wish it wasn't so. It's not quite what we imagined when we made the leap to dscms in the early aughts.

All the good stuff is still in there, though, and it's still as possible as ever to do different things, so it's not a bleak situation.

Re: GitHub Package Registry

#128

Post by adamscybot »

jonnyscholes wrote: post #56
mfatica wrote: post #22

Earlier quoted context omitted.

The same way it works today when you utilize packages from multiple repositories. Github isn't the first non-npm repository in existence.

What if they clash (eh user/package exist both on npmjs.com and GitHub)? Does it go through each of the configured repositories in sequence looking for a match?

You configure the NPM client on what your primary registry is. I think this github repo will mirror everything on NPM (?).

Re: GitHub Package Registry

#129

Post by yarg »

_bxg1 wrote: post #115

There's something slightly concerning about ceding responsibility for distributing the world's open-source projects from a family of strong independent repositories to a centralized platform owned by a tech giant.

Hopefully something along these lines will also be added to Gitab.

I share your concerns, but I've also long had the feeling that both NPM and Maven are a security disaster in the making.

Having the dependencies being published from the same place that stores the actual code, gives me a little hope that things will improve from the security and design perspective.

Re: GitHub Package Registry

#130

Post by beenBoutIT »

sho_hn wrote: post #127
_bxg1 wrote: post #115

There's something slightly concerning about ceding responsibility for distributing the world's open-source projects from a family of strong independent repositories to a centralized platform owned by a tech giant.

Yes, but that's not a new concern - to some, GitHub has always represented an anathema to what git was supposed to be and bring. Centralization at a proprietary vendor, instead of open systems interacting. Then locking people in further by network effect and adding centralized products around git. That it's become so popular many people equate GitHub with git adds insult to injury. I completely understand why this al…

*When the tech giant is Microsoft.
Post reply on HN