Fixed as of 22:30 UTC. Hope there's a postmortem.
NPM website was down
31–40 of 65 posts
Re: NPM website was down
#32That's one way to fix supply chain vulnerabilities.
More seriously, keeping a local cache of external npm packages, and a local artifact storage for internal npm packages looks like a wise thing to have done long ago. Might be cheaper in the long run. Ironically, both Nandu and Verdaccio are implemented in Tyepscript and install via npm. (Same logic obviously applies to Python packages, Docker images, etc.)
Caching NPM was easier when you could pull the Couchbase replicate API. Afaik that's gone and now you just have to send a bazillion http requests instead.
Re: NPM website was down
#33That's one way to fix supply chain vulnerabilities.
More seriously, keeping a local cache of external npm packages, and a local artifact storage for internal npm packages looks like a wise thing to have done long ago. Might be cheaper in the long run. Ironically, both Nandu and Verdaccio are implemented in Tyepscript and install via npm. (Same logic obviously applies to Python packages, Docker images, etc.)
Only if we had a turn key distributed cache, like IPFS
Re: NPM website was down
#34Ebay is also down.
https://www.isitdownrightnow.com/ebay.com.html
Re: NPM website was down
#35Earlier quoted context omitted.
More seriously, keeping a local cache of external npm packages, and a local artifact storage for internal npm packages looks like a wise thing to have done long ago. Might be cheaper in the long run. Ironically, both Nandu and Verdaccio are implemented in Tyepscript and install via npm. (Same logic obviously applies to Python packages, Docker images, etc.)
Only if we had a turn key distributed cache, like IPFS
Waiting for the BitTorrent package manager
Re: NPM website was down
#36Tailscale too: https://status.tailscale.com/
Re: NPM website was down
#37Hold the jokes until we're sure this isn't an `.unwrap()`
Re: NPM website was down
#38With all the github instability, I wonder if Cloudflare or some other provider is going to look into providing a similar service.
GitLab is right there . And overall provides a better product than GitHub, if nothing else on these two points: * You can actually have an organisational structure (folders/namespaces), and projects can be moved around with automatic redirects. Also, inheritance of access controls, variables between the namespaces * GitLabCI is organised in a way that makes supply chain attacks less of a risk. GitHub Actions takes th…
GitLab also limits the size of PRs/MRs, which makes it Unfit for Purpose. :( :( :(
Its a problem they know about, but have no plan to fix before 2027.
Re: NPM website was down
#39Earlier quoted context omitted.
More seriously, keeping a local cache of external npm packages, and a local artifact storage for internal npm packages looks like a wise thing to have done long ago. Might be cheaper in the long run. Ironically, both Nandu and Verdaccio are implemented in Tyepscript and install via npm. (Same logic obviously applies to Python packages, Docker images, etc.)
Only if we had a turn key distributed cache, like IPFS
Does IPFS support content eviction now? If not, that could go wrong really fast. You get a compromised package out there and then, I think, literally every node needs to unpin it or it remains.
Re: NPM website was down
#40Earlier quoted context omitted.
GitLab is right there . And overall provides a better product than GitHub, if nothing else on these two points: * You can actually have an organisational structure (folders/namespaces), and projects can be moved around with automatic redirects. Also, inheritance of access controls, variables between the namespaces * GitLabCI is organised in a way that makes supply chain attacks less of a risk. GitHub Actions takes th…
GitLab also limits the size of PRs/MRs, which makes it Unfit for Purpose. :( :( :( Its a problem they know about, but have no plan to fix before 2027.
I mean, the PR limit is like a million characters. I would also reject a PR of a million characters. That’s bananas.