Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub Package Registry

github.com

Post reply on HN
Print view View original

331–340 of 389 posts

Re: GitHub Package Registry

#331

Post by diggan »

bengale wrote: post #324
diggan wrote: post #316

Earlier quoted context omitted.

Yeah, today that's so. The problem with for-profit companies is that there is nothing keeping that from staying like that, except the goal of earning a profit. The moment the outlook of earning a profit changes, the company has to adjust and sometimes that doesn't affect the users. But sometimes it does, and it's those cases Open-Registry is trying to prevent from ever happening. Let's say the community comes up with…

I think this is somewhat mitigated with Microsoft these days because of their motivations for buying GitHub. For them this endeavour seems to be focused on winning developers hearts and minds rather than seeing how much profit they can make from it. Clearly they have a business case for this, but it seems more to be more geared towards making azure more and more profitable instead.

I'm not as sure as you are. Sure, as it seems today, Microsoft wants developers to be as happy as possible. But in the end, Microsoft is not running a non-profit. They are running a for-profit company and the motive is simple: earn a profit.

Today, they can afford not earning as much on their new Package Manager as they earn money elsewhere. But that's no guarantee they will act the same way tomorrow.

We've seen Microsoft go back and forth in the developers minds, and I'm sure we will see more movements back and forth in the future. Right now, things are good though.

Re: GitHub Package Registry

#332

Post by diggan »

diggan wrote: post #283

It's a really nice project overall, having a registry that supports many different projects and run by a company that today is good, is always nice. But we been here before. We trusted npm and now they are trying to squeeze out a profit, and it ruins it for the users. I'm happy to be proven wrong, but every for-profit company that runs a package registry, eventually stagnates, and ends up implementing things that are…

As my original comment is too old to be edited. Just wanted to add some more of my thoughts on the issue but it became to long to post here, so ended up with a separate blog post. You can read it here: https://dev.to/victorb/the-everlong-quest-for-the-perfect-pa...

Re: GitHub Package Registry

#333

Post by Ayesh »

mikey_p wrote: post #106
selrond wrote: post #13

This could solve the trust issues with npm - you never know, whether the package you're installing is really from the source provided on its npm page

This is one of the things I love about Packagist. Technically Composer doesn't care where the source is from, but the official Packagist repository actually just uses Github as the storage and CDN for downloads. You have to link a repo to publish it, and Packagist will only publish source committed to your repo (no build steps, etc). Packagist then uses the zipball downloads for each package for it's source. Downside…

Composer/packagist has done many things right: namespaced packages, and downloads straight from VCS to name a few.

I wouldn't consider the Github personal token to be an issue either. It's a one-time setup per device, and my server (which only pulls code) never needed one, because it uses the lock files to download the exact commit/tag, and this significantly reduces the number of API calls made.

Re: GitHub Package Registry

#334

Post by frizkie »

15characterslon wrote: post #100
mceachen wrote: post #34

Doesn't this bifurcate the namespace of literally every packaging system they are supporting, or are they requiring `@author/`-namespaced package names? In the livestream he pokes around a github repo, sees it's one author, and decides that what makes it trustworthy? No GPG signing? The new Actions support (about 50 minutes into the live stream) for auto-publishing from master is pretty sweet. From the very cursory d…

GitHub Actions are pretty neat. They were announced last year and I've started using them a few months ago. You can sign up for the beta here: https://github.com/features/actions Introduction: https://www.youtube.com/watch?v=_yPml1iTbmM I'm a little bit anxious because the pricing has not yet been published. Both GitHub Actions and package registry will be free for public repositories but it is not yet known how much…

They said they expected the package registry to be included in all paid plans. So it's only going to cost you anything if they decide to raise prices for everything across the board, it seems.

Re: GitHub Package Registry

#335

Post by frizkie »

rich-tea wrote: post #234
yes_man wrote: post #157

Is centralization of open source a good thing for the world or not? This thread seems to be overwhelmingly positive. And in the end we all will be critisizing it if all package repositories will be handled by a single entity. And that entity that is being applauded here in this case happens to be the most valuable corporation in the world right now. Healthy skepticism seems to be a disappearing attribute in the tech…

As usual it will take a disaster for people to realise it was a bad idea. Microsoft tried to destroy Linux in the past. Literally. Linux is what gave us git in the first place, and docker, and so much technology that we love today. Oh how quickly the past is forgotten when convenience is on the table.

What about GitHub makes people more likely to use Windows? Or less likely to use Linux?

Re: GitHub Package Registry

#336

Post by user5994461 »

OJFord wrote: post #143
dend wrote: post #138

Earlier quoted context omitted.

docs.microsoft.com PM here - thanks for the feedback! It takes some time to update all our search results across the two major search engines. Given that some pages have less traction than others, the more obscure content sometimes still is indexed as if it's coming from MSDN. We have moved most of the library to docs, with redirects in place, so hopefully you won't get too many 404s. If you do - feel free to report…

> the two major search engines What's the second major search engine? I'm genuinely asking, not meaning to poke if it's Bing - I use DDG but just don't have a feel at all for what's most popular after the obvious one. Wikipedia has just 7% market share left for the second, and the rest - thinking about it's probably one that's popular in China and unheard of elsewhere?

What is the first search engine?

Baidu in China. Yandex in Russia. Google in the US. Not sure for India and Latin America.

The poster was probably thinking of Bing though, which is ironic because it's maybe less used than these.

Re: GitHub Package Registry

#337

Post by user5994461 »

duskwuff wrote: post #170
flunhat wrote: post #93

Earlier quoted context omitted.

In light of StackOverflow looking for a new CEO, layoffs in the past year and a half, $68 million in venture capital looking for a return, and Joel Spolsky's connections to Microsoft, this might actually happen. I've also gotten the impression that StackOverflow's recruiting product isn't doing so well. It seems to be a few hundred dollars a month for a single job posting, but the results for recruiters are apparentl…

StackOverflow for Teams seems like a really hard sell too. $5-10/user/mo is pretty steep, especially for a service that needs a significant-size userbase to "work".

Just seen it adopted in a F50. It's not particularly difficult to sell in my opinion. The product is pretty good too.

Re: GitHub Package Registry

#338

Post by GordonS »

phreack wrote: post #227
carlosdp wrote: post #113

Earlier quoted context omitted.

I think YMMV on this, cause I also know of a lot of repos that explicitly close any issues that are support requests because they fill up the issue list so quickly. I think having it separate as in SO is still going to be the move unless there's some big re-organization of how Issues work.

This is quite true but it's boggling why neither Github nor its competitors haven't added a 'questions' tab to public repos where people are explicitly allowed to ask questions, and have them answered by maintainers or other users.

Quite a few repos point people towards Gitter instead.

Re: GitHub Package Registry

#339

Post by GordonS »

your-nanny wrote: post #225
owaislone wrote: post #79

Earlier quoted context omitted.

> All they need now is a place to get coding questions answered I think Github issues has already started doing that. Personally, I've been finidng more help from Github issues than Stack Overflow, plus I find myself asking questions or submitting bugs on GH a lot more than asking something on Stack Overflow. In fact, I've not asked anything on SO for years now.

Please don't put support questions in issues!

Please have an alternative then!

Re: GitHub Package Registry

#340

Post by GordonS »

keytarsolo wrote: post #289
franky47 wrote: post #54

While the technical side of the news is interesting, the organisational repercussions worry me. Microsoft (who owns GitHub) is already one of the largest tech companies, and I would not be surprised if this move was intended to weaken NPM and Docker in an attempt to acquire them. I fear a future where everything one requires to develop "socially" depends on a single super-entity. GitHub and VSCode were the first step…

I'm glad you brought up Docker, but I think this is a move against GitLab, more than it is against NPM or Docker. Lots of us use GitLab at work because it's such a complete product. Source code, container registry, CI/CD, Issues (via GitLab or Jira), Maven repository, NPM repository, etc. etc. Microsoft is trying to build out GitHub so that they can more effectively compete for GitLab's corporate customers. Since buy…

Microsoft's Azure DevOps already has everything corporate customers could want though - AD integration, CI/CD (even hosted MacOS build agents!), choice of TFVC or Git, task boards, testing stuff...
Post reply on HN