Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub Package Registry

github.com

Post reply on HN
Print view View original

271–280 of 389 posts

Re: GitHub Package Registry

#271

Post by akavel »

soulofmischief wrote: post #213
toyg wrote: post #178

Earlier quoted context omitted.

That's the thing - git was fundamentally a tool borne with an asynchronous workflow in mind: I work on X, Alice works on Y, Bob works on Z, and the eventual merging (which might happen days or weeks later) should be as simple as possible - without worrying about who checked out what. Git was dropped in the "distributed VCS" bucket, but decentralization was a secondary effect of the workflow Linus wanted to achieve. G…

A git service built on IPFS or something similar would be wicked. It does take quite a bit of engineering (money) to compete with the big boys, however.

There's a Git application on Scuttlebutt, already used by people in the community - see e.g.:

https://github.com/noffle/git-ssb-intro

Re: GitHub Package Registry

#272

Post by soulofmischief »

chupasaurus wrote: post #217
soulofmischief wrote: post #213

Earlier quoted context omitted.

A git service built on IPFS or something similar would be wicked. It does take quite a bit of engineering (money) to compete with the big boys, however.

The first project provided by DDG to me was Radicle[ https://radicle.xyz/ ]

rad project allows you to create, checkout, manage, and publish a project, comprised of issues, patch proposals, and a git repo.

Well hot dog.

And it uses LISP for scripting? Nice.

Interesting approach to saving state, too.:

One only needs the address of the latest input, the "head", to be able to recover the whole log. The owner of a machine uses an IPNS link to point to the head of the list, and the name of this link is then the name of the machine also.

Thanks for sharing that. Definitely going to give it a whirl this weekend.

Re: GitHub Package Registry

#273

Post by soulofmischief »

shusson wrote: post #265
ssalka wrote: post #222

Earlier quoted context omitted.

Same. Was hoping this would be an alternative to NPM, but it just builds on top of it

It's an alternative to the NPM registry.

Yes, parent confused me... It is entirely orthogonal from NPM, correct?

Re: GitHub Package Registry

#274

Post by rswail »

rectang wrote: post #165
sundvor wrote: post #140

Earlier quoted context omitted.

A lot has happened since IE6.. I think it might be time to move on. Eg their main focus for .net Core has been multi platform - ie the last 3-4 years! Visual Studio Code. And on browsers they are building what will probably be a better Chromium than Google's Chrome, in the new Edge.

I don't think developers should place too much trust in any platform vendor. (Apple and Swift, Apple and Metal, Google and AMP, Google and Dart, Amazon and AWS... the list is endless.) Their interests are fundamentally at odds with ours. Platform vendors benefit when developers are locked in by network effects. Developers maximize their value when their skills are transferable. And that goes for Github and its packag…

Except that in the commerical software world, you can't stay independent with "purity".

The costs of supporting multiple cloud providers is still a cost. K8S, Docker, Pulumi, Packer are starting to reduce that interoperability gap, but it's still a friction.

I've moved to .NET on Ubuntu for our current project (I'm an Engineer Manager/Architect, but the team is C#). It's been remarkably smooth and low friction.

So it's a balance, the interests of a platform vendor are of course that you stay on their platform. But currently there's enough competition that it's still a buyers market.

AWS is getting a bit too powerful, Azure is doing a good job of keeping MS shops in the MS world, but GCP is disappointing.

Re: GitHub Package Registry

#275

Post by CamouflagedKiwi »

dtech wrote: post #269
CamouflagedKiwi wrote: post #246

Earlier quoted context omitted.

Unfortunately the GPG signing is worthless because there's no way of attaching trust to each key. So each package has been signed, but anyone could have issued the keys, so an attacker could easily do the same. Also, not all artifacts have sources and javadoc. Most do but some certainly don't.

> So each package has been signed, but anyone could have issued the keys, so an attacker could easily do the same. Not true. The GPG signature means the key belongs to an account with access to the group id (namespace, usually a domain), and that sonatype has verified the group id belongs to the original admin account for that group id. It's not a lot of guarantees, but you cannot just generate a GPG key, sign a pack…

Anyone can issue a GPG key claiming to be whatever identity they want though. I've uploaded artifacts to Maven Central before and they didn't do any specific verification of the signing key - so if it just matches the domain that is no protection at all.

Re: GitHub Package Registry

#276

Post by soulofmischief »

akavel wrote: post #271
soulofmischief wrote: post #213

Earlier quoted context omitted.

A git service built on IPFS or something similar would be wicked. It does take quite a bit of engineering (money) to compete with the big boys, however.

There's a Git application on Scuttlebutt, already used by people in the community - see e.g.: https://github.com/noffle/git-ssb-intro

Your sister comment had another project to share based on IPFS: https://radicle.xyz/

One thing that seems clear is that there needs to be a standard interchangeable format for storing PRs and issues, so that it's not just the point of origin that's decentralized, but the data itself (in case the maintainers vanish).

I'm not really sure how to go about that sort of thing either myself or as a community effort but I'd appreciate any advice from the HN community.

Re: GitHub Package Registry

#277

Post by CamouflagedKiwi »

wst_ wrote: post #263
CamouflagedKiwi wrote: post #246

Earlier quoted context omitted.

Unfortunately the GPG signing is worthless because there's no way of attaching trust to each key. So each package has been signed, but anyone could have issued the keys, so an attacker could easily do the same. Also, not all artifacts have sources and javadoc. Most do but some certainly don't.

So continuing this way GPG is worthless in general. Most of the keys you can't verify in person so there is no trust whatsoever. In this case Sonatype is verifying key for you. They will check if your key belongs to you and you are in control of your organization. Otherwise package would not be accepted. I may be wrong but source and javadoc are requirements. Maybe there are some old packages without it, but new ones…

Maybe they're historic and now it's a requirement, or maybe it's prereleases or something, but I have certainly seen some in the past. First one I can dig up: https://repo1.maven.org/maven2/com/google/protobuf/protobuf-... The newer versions certainly do have sources and javadoc, but you can't assume their presence for everything.

Re: GitHub Package Registry

#278

Post by tluyben2 »

ElijahLynn wrote: post #116
gigatexal wrote: post #90

Earlier quoted context omitted.

The stack at SO is heavy on MS tech too. I believe they run a lot of SQLServer.

Truth, I was at SO in Manhattan for a JS meetup a couple times and all the desktop computers were PCs with Dell monitors.Not a single Mac in sight. Have a feeling they weren't running linux either since Stack Overflow is .NET I believe.

> running linux either since Stack Overflow is .NET I believe

It is a matter of taste and I'm sure these guys (Atwood/Spolsky) love Windows to work on, but with .NET Core (we started porting when the first stable ASP.NET Core came out), we ported/migrated everything from Windows/MS (SQL server, Windows Server, AD, etc) to Linux + MySQL/Postgresql on ASP.NET Core.

I guess it's what you are used to, but everything is faster, smoother, more stable/consistent and easier to manage now. I would never go back.

Re: GitHub Package Registry

#279

Post by NeedMoreTea »

rswail wrote: post #270
ksec wrote: post #242

Earlier quoted context omitted.

>As a developer who still has to work very hard to forgive MS for all the pain IE6 put me through a decade ago, this grates on my ears, even though I understand that it might be true in the abstract. Yes, Active X, Windows, Java etc, and god knows how many awful things they did I cant remember them all. But years later Bill Gate decide to donate his wealth to good cause. Not only is this not a PR / Marketing Stunt, h…

Back in the 80s, IBM was evil, Apple and Microsoft were good. I have an "I HATE IBM" badge from a very early computer show. MS was mainly known for its languages and its apps, more than the OS. IBM PCs still came with CP/M or PCDOS (MSDOS). Then when Windows 3 came out, MS started to act like IBM but on steroids, thinking they owned the "stack" (as it was). OS/2 was the last attempt to extract the "PC compatible" wor…

Microsoft started acting like IBM from the moment the DOS licensing was agreed with IBM. Incredibly naive on IBM's part, or perhaps they simply expected to sell so few machines it wouldn't matter. After all the first PC was deliberately crippled to stay away from more expensive IBM kit.

MS were acting like mini IBM throughout the 80s, and before the mid 80s had very much gained a negative reputation globally. It was against Microsoft, not IBM, that was the usual target of complaint when the first AT clones were coming out - 84? 85? I think Windows 1 was about the same time. Certainly enough of a reputation to be amazed they were still collaborating with IBM to produce the first OS/2, again around the mid 80s.

Re: GitHub Package Registry

#280

Post by manojlds »

pornel wrote: post #117

I worry about npm now. The huge public registry everyone loves is run off investor's money and subsidized by npm's private registry product. But npm has recently changed their nice-people-matter CEO to a now-print-money dude, so I suspect investors' patience has run out. And now GitHub went directly after the one thing that npm is supposed to be making money on.

So.....this is actually good thing that we as a community are not dependent on a single actor?
Post reply on HN