Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub Package Registry

github.com

Post reply on HN
Print view View original

181–190 of 389 posts

Re: GitHub Package Registry

#181

Post by IfOnlyYouKnew »

_bxg1 wrote: post #115

There's something slightly concerning about ceding responsibility for distributing the world's open-source projects from a family of strong independent repositories to a centralized platform owned by a tech giant.

That is, indeed, a fair point of concern. But in practical terms, I would place Github very high in any ranking of good things that happened to open source.

It's possible many people have forgotten, or are to young to remember, how the ecosystem worked pre-Github. There was sourceforge, which wasn't quite the disaster it is today, but also not very good. But mostly I remember every project using different, often hand-rolled systems. PRs had to be sent in by mail. Every project had their own conventions of where to send patches, what formats to use, what additional information to provide etc.

Just try figuring out how to get a patch into Debian, which is still where most projects were ca. 2005. I won't wait.

I never contributed to OSS pre-Github. These days, I routinely send in a patch for smaller things I encounter a few times per week. Over time, I have also started becoming a more involved contributed to two projects. I doubt this would have happened without the flat learning curve that Github provides.

I wouldn't be surprised if both the number of contributors and total contributions to OSS have soared by a factor like 5x even above just the growth in OSS usage, and Github is the obvious reason for it.

Re: GitHub Package Registry

#182

Post by femto113 »

nerdponx wrote: post #148
femto113 wrote: post #61

Earlier quoted context omitted.

Maybe because PyPI has a closer relationship with Python than the other package managers have with their core tech?

I don't see how that's relevant. Hosting your own Python package index isn't easier than hosting any other, as far as I'm aware.

Less technical and more political. Python has a bureaucracy that can take let’s say “a while” to decide things. If GitHub approached them about this it wouldn’t surprise me if they’re still debating whether to condone it.

Re: GitHub Package Registry

#183

Post by prh8 »

mceachen wrote: post #37
prh8 wrote: post #26

Earlier quoted context omitted.

What does Gitlab have that this is competing with? I know Gitlab's docker registry but not of a package registry.

Gitlab's CI pipelines look an awful lot like github's new Actions tab.

Gitlab's CI is really great, so if Github's Actions are at comparable, that's pretty nice.

Re: GitHub Package Registry

#184

Post by prh8 »

foxylion wrote: post #47
prh8 wrote: post #26

Earlier quoted context omitted.

What does Gitlab have that this is competing with? I know Gitlab's docker registry but not of a package registry.

Yes, it has a package registry feature for NPM and Maven: Maven: https://docs.gitlab.com/ee/user/project/packages/maven_repos... NPM: https://docs.gitlab.com/ee/user/project/packages/npm_registr...

Ahh thank you. I don't really pay attention to either of those ecosystems so I hadn't realized it.

Re: GitHub Package Registry

#185

Post by acdha »

PureParadigm wrote: post #89

I'm worried about the resiliency of code distribution as we continue the trend of centralizing distribution in a few large companies. GitHub has had service outages in the past, so what happens when not just our repositories but also now packages are not accessible the next time that happens? It would be great if they'd implement it using an open/decentralized protocol such as IPFS, so that even if GitHub went down t…

The problem is that hosting and bandwidth aren’t free and abuse is a big problem. Managing a distributed petabyte-scale archive which gets updated so frequently is a significant engineering problem even for a single party — now consider how you’d handle redundancy and routing when you can’t rely on any of the parties involved, and you have enough different objects being accessed to turn away most participants unless you can guarantee that participating won’t blow your ISPs data caps, interfere with other use, etc.

Abuse is the other huge problem: think about what happens when you’re hosting some BLOBs and the FBI shows up at your door because someone uploaded some kind of contraband and some of it was available from your IP address. How many people are going to setup completely independent hosting accounts to avoid fallout from something like that which happens so regularly?

The closest thing which comes to mind is the Debian mirror network and that is something of a historical fluke, predating centralized hosting being possible, and scoped to a much smaller set of more trusted participants. That also hits the big problem that even with a fair amount of infrastructure backing it, it’s hard to match the user experience of something like Github or NPM so the most likely case is spending a lot of time in hard problems but not overcoming the basic economics, as seems to be happening to IPFS.

Re: GitHub Package Registry

#186

Post by femto113 »

femto113 wrote: post #182
nerdponx wrote: post #148

Earlier quoted context omitted.

I don't see how that's relevant. Hosting your own Python package index isn't easier than hosting any other, as far as I'm aware.

Less technical and more political. Python has a bureaucracy that can take let’s say “a while” to decide things. If GitHub approached them about this it wouldn’t surprise me if they’re still debating whether to condone it.

See for example this PEP suggesting they use GitHub issues for the CPython repo hosted on GitHub, opened a year ago https://www.python.org/dev/peps/pep-0581/

Re: GitHub Package Registry

#187

Post by ccleve »

adambatkin wrote: post #142
ccleve wrote: post #31

This is really outstanding. It will mean the death of Maven Central, about which I have mixed feelings. On the one hand, Sonatype deserves enormous thanks for what they have done for the open source world, as does mvnrepository.org. Their central repository has been free and maintained for a long time. Thank you, Sonatype. On the other hand, it took me three days to release a new version of one of my artifacts the ot…

Publishing to Maven Central comes with a bunch of requirements ( https://central.sonatype.org/pages/requirements.html ) may be seen as a burden to packagers, but is certainly a delight for end-users of those packages. All packages are GPG signed, come with companion source and javadoc artifacts, and are guaranteed a certain amount of other metadata in the POM. There are "easier" repositories (like Bintray jcenter) bu…

Agree. It would be good if Github could enforce some standards as well. Maybe I should read the docs to see if they do...

Re: GitHub Package Registry

#188

Post by dplgk »

flunhat wrote: post #93
jackfoxy wrote: post #33

Earlier quoted context omitted.

Pure speculation, it would not surprise me to wake up someday and see MS has bought Stackoverflow. Given their direction of integrating the entire developer experience, it would make sense. MS is upgrading technical docs across the board, organizing and linking to SO content would make sense.

In light of StackOverflow looking for a new CEO, layoffs in the past year and a half, $68 million in venture capital looking for a return, and Joel Spolsky's connections to Microsoft, this might actually happen. I've also gotten the impression that StackOverflow's recruiting product isn't doing so well. It seems to be a few hundred dollars a month for a single job posting, but the results for recruiters are apparentl…

I've had great success finding devs for my company on SO. I would hate to see it go away.

Re: GitHub Package Registry

#189

Post by tantalor »

Can somebody explain the technical accomplishment here? What's new about this? Github already hosts source. What do they mean by "package"? Is it just source? I don't get it.
Post reply on HN