Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub Package Registry

github.com

Post reply on HN
Print view View original

241–250 of 389 posts

Re: GitHub Package Registry

#241

Post by herewulf »

toyg wrote: post #178
tedivm wrote: post #152

Earlier quoted context omitted.

When Linus introduced git he didn't seem to care at all about decentralizing from a political standpoint, just from a "I can work on this from my laptop without an internet connection" point of view.

That's the thing - git was fundamentally a tool borne with an asynchronous workflow in mind: I work on X, Alice works on Y, Bob works on Z, and the eventual merging (which might happen days or weeks later) should be as simple as possible - without worrying about who checked out what. Git was dropped in the "distributed VCS" bucket, but decentralization was a secondary effect of the workflow Linus wanted to achieve. G…

Interesting discussion on this topic from about a year ago: https://news.ycombinator.com/item?id=17234498

Re: GitHub Package Registry

#242

Post by ksec »

rectang wrote: post #101
bluGill wrote: post #38

Earlier quoted context omitted.

MS's core competency has always been developers. IBM called Microsoft for BASIC back in the day because without MS BASIC their computer was DOA to a lot of potential customers.

> MS's core competency has always been developers. As a developer who still has to work very hard to forgive MS for all the pain IE6 put me through a decade ago, this grates on my ears, even though I understand that it might be true in the abstract. Classically, MS has been good to developers who agree to be chained to their platform, but has made life extremely difficult for developers who want or need to be platfor…

>As a developer who still has to work very hard to forgive MS for all the pain IE6 put me through a decade ago, this grates on my ears, even though I understand that it might be true in the abstract.

Yes, Active X, Windows, Java etc, and god knows how many awful things they did I cant remember them all. But years later Bill Gate decide to donate his wealth to good cause. Not only is this not a PR / Marketing Stunt, he is actually using his time and energy running it. That alone halves whatever hatred I have had.

Ever since they lost the Smartphone OS race ( if you consider they were even part of it ), I don't consider M$ a monopoly or threat any more.

And given the amount of Good things they have done since new CEO took helm, WSL, and now WSL2, VS Code, .Net Fully Open Sources with MIT license, ditching IE ( God that feels good ) , Direct X RT, along with lots of Research put out, I think it is worth reevaluating that hatred against M$ we once had.

We have no lasting friends, no lasting enemies, only lasting interests.

Re: GitHub Package Registry

#243

Post by dend »

OJFord wrote: post #143
dend wrote: post #138

Earlier quoted context omitted.

docs.microsoft.com PM here - thanks for the feedback! It takes some time to update all our search results across the two major search engines. Given that some pages have less traction than others, the more obscure content sometimes still is indexed as if it's coming from MSDN. We have moved most of the library to docs, with redirects in place, so hopefully you won't get too many 404s. If you do - feel free to report…

> the two major search engines What's the second major search engine? I'm genuinely asking, not meaning to poke if it's Bing - I use DDG but just don't have a feel at all for what's most popular after the obvious one. Wikipedia has just 7% market share left for the second, and the rest - thinking about it's probably one that's popular in China and unheard of elsewhere?

I was referring to Bing and Google - not because I am trying to omit anything, but rather because these are the two I use the most on the day-to-day.

Re: GitHub Package Registry

#244

Post by dend »

DaiPlusPlus wrote: post #153
dend wrote: post #138

Earlier quoted context omitted.

docs.microsoft.com PM here - thanks for the feedback! It takes some time to update all our search results across the two major search engines. Given that some pages have less traction than others, the more obscure content sometimes still is indexed as if it's coming from MSDN. We have moved most of the library to docs, with redirects in place, so hopefully you won't get too many 404s. If you do - feel free to report…

Question: Why is Offline documentation and the Help Viewer in Visual Studio 2017 still horribly broken? I keep it around for when I don’t have internet access but it’s next to useless. Why keep up the pretence? (In comparison, the CHM and DocEx from VS6 through VS2008 work perfectly and are very reliable)

What particular aspect of it is broken? Genuinely asking the question, because I want to make sure we address major issues in the customer experience that you have.

Re: GitHub Package Registry

#246

Post by CamouflagedKiwi »

adambatkin wrote: post #142
ccleve wrote: post #31

This is really outstanding. It will mean the death of Maven Central, about which I have mixed feelings. On the one hand, Sonatype deserves enormous thanks for what they have done for the open source world, as does mvnrepository.org. Their central repository has been free and maintained for a long time. Thank you, Sonatype. On the other hand, it took me three days to release a new version of one of my artifacts the ot…

Publishing to Maven Central comes with a bunch of requirements ( https://central.sonatype.org/pages/requirements.html ) may be seen as a burden to packagers, but is certainly a delight for end-users of those packages. All packages are GPG signed, come with companion source and javadoc artifacts, and are guaranteed a certain amount of other metadata in the POM. There are "easier" repositories (like Bintray jcenter) bu…

Unfortunately the GPG signing is worthless because there's no way of attaching trust to each key. So each package has been signed, but anyone could have issued the keys, so an attacker could easily do the same.

Also, not all artifacts have sources and javadoc. Most do but some certainly don't.

Re: GitHub Package Registry

#247

Post by eitland »

sanbor wrote: post #245

If a government gets ssl certs of github then it will possible to MITM and distribute infected deps on millions of projects.

Same as if they pwn debian, redhat, docker, npm, maven (also used by gradle) or Microsoft Windows update infrastructure then?

Or am I missing something?

Re: GitHub Package Registry

#248

Post by nathan_f77 »

I'm working on a SaaS service for developers, so I've built some API client libraries using openapi-generator [1] (using my OpenAPI specification.) The hardest part (by far) has been signing up for all of these different package manager services and figuring out how to release the libraries. Java and Maven was particularly difficult.

It sounds so nice to be able to release all of my packages on one centralized service. I hope they support PHP and Python soon.

[1] https://github.com/OpenAPITools/openapi-generator

Re: GitHub Package Registry

#249

Post by ksec »

>Github CDN

Does any one know if this is actually their own CDN with PoPs around the world, of do they really mean Azure ( Microsoft ) or Fastly, which they were using at one point?

Re: GitHub Package Registry

#250

Post by manojlds »

koolba wrote: post #112
flunhat wrote: post #93

Earlier quoted context omitted.

In light of StackOverflow looking for a new CEO, layoffs in the past year and a half, $68 million in venture capital looking for a return, and Joel Spolsky's connections to Microsoft, this might actually happen. I've also gotten the impression that StackOverflow's recruiting product isn't doing so well. It seems to be a few hundred dollars a month for a single job posting, but the results for recruiters are apparentl…

I think they use SQL Server as well so there’s that poster child angle as well.

SO is primarily MS Dev stack.
Post reply on HN