Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NPM CEO Bryan Bogensberger Resigned

prnewswire.com

Post reply on HN
Print view View original

51–60 of 108 posts

Re: NPM CEO Bryan Bogensberger Resigned

#51

Post by duxup »

Ididntdothis wrote: post #10
hn_throwaway_99 wrote: post #5

I wish companies would do away with the "leaving to pursue other opportunities" nonsense and just give no reasons if they don't want to discuss it. No C-level exec resigns "effective immediately" without either a transition plan in place or something concrete lined up. I get wanting to allow him to say he resigned instead of he was fired, but the silly language of the press release just makes it worse.

Maybe “he wants to spend more time with family”?

Maybe it is true.

"Man I hate this place because ____, and I'd rather spend time with my family."

That doesn't preclude wanting to do other things too.

Re: NPM CEO Bryan Bogensberger Resigned

#52

Post by Sephr »

Under Bryan's leadership, multiple namespaces (left-pad, etc.) including my own (file-saver) have been wrongly transferred to new owners without authorization from the previous owners.

npm can't handle security, and they have been sorely in need of new leadership for years.

Re: NPM CEO Bryan Bogensberger Resigned

#53

Post by pluma »

TimothyBJacobs wrote: post #24
asien wrote: post #18

I’m fascinated by the fact that while node has become a new standard in the industry , and the project is receiving lots of supports from all sorts of companies ( IBM , Microsoft etc...) absolutely no discussion has been opened about how much at risk the JavaScript ecosystem actually is with « npm » and it’s weekly dramas Not a month pass without something going wrong inside of inc, millions of developers are dependa…

There has been. CJ Silverio gave a talk on that topic at JSConf this year: https://www.youtube.com/watch?v=MO8hZlgK5zc See also Entropic as a possible alternative to NPM: https://github.com/entropic-dev/entropic

For context: Entropic was started by several former npm Inc core developers including CJ who left the company after the CEO change was announced internally. CJ herself is the former CTO of npm Inc.

Basically most of the top developers have left the company, others were laid off. It seems to be only a matter of time until none of the people working on npm a year ago remain.

Re: NPM CEO Bryan Bogensberger Resigned

#54

Post by jonny_eh »

cjblomqvist wrote: post #42
asien wrote: post #18

I’m fascinated by the fact that while node has become a new standard in the industry , and the project is receiving lots of supports from all sorts of companies ( IBM , Microsoft etc...) absolutely no discussion has been opened about how much at risk the JavaScript ecosystem actually is with « npm » and it’s weekly dramas Not a month pass without something going wrong inside of inc, millions of developers are dependa…

Honest question, is it that much better in other communities? In particular, it's there anything inherent to npm that's problematic or is it just that a huge community with a Unix mindset (small packages that does one thing well) is problematic?

Any community dependent on a particular repo is at risk. I'd argue that RubyGems is just as risky as NPM, for example.

The problem is that there's no good fix or alternative, it's hard to avoid a single point of failure.

Re: NPM CEO Bryan Bogensberger Resigned

#55

Post by pluma »

cpeterso wrote: post #20
jeremiahlee wrote: post #4

Under Bryan Bogensberger's leadership, npm lost: - its CTO - its COO co-founder - some fantastic people in the JavaScript community - a federal labor dispute - its culture - its reputation - its business model to Github

And he has only been CEO for eight months (January 2019). https://blog.npmjs.org/post/181872197694/npm-inc-has-a-new-c...

To be fair, people started leaving last year when the leadership change was first announced internally.

Re: NPM CEO Bryan Bogensberger Resigned

#56

Post by jonny_eh »

alexbanks wrote: post #34
hn_throwaway_99 wrote: post #26

Earlier quoted context omitted.

That's my whole point. I fully understand not wanting to air everyone's laundry. I'm just suggesting that nobody is buying their silly lies, so if they think they are "controlling the narrative" they are sorely mistaken.

Everyone knowing he's lying is probably a better PR situation than everyone knowing the truth.

It's sad that we tolerate such blatant lies as normal.

Re: NPM CEO Bryan Bogensberger Resigned

#57

Post by kanox »

cols wrote: post #46
sneak wrote: post #41

Earlier quoted context omitted.

Why was he asked to leave? To which “terrible optics” do you refer? Your implied context is opaque.

If the context is opaque to you then I would encourage you to read the articles and to read the other comments on this thread.

As far as I can tell a bunch of people are upset because they got fired - so what? Companies fire people all the time.

Re: NPM CEO Bryan Bogensberger Resigned

#58

Post by [deleted] »

Sephr wrote: post #52

Under Bryan's leadership, multiple namespaces (left-pad, etc.) including my own (file-saver) have been wrongly transferred to new owners without authorization from the previous owners. npm can't handle security, and they have been sorely in need of new leadership for years.

[deleted]

Re: NPM CEO Bryan Bogensberger Resigned

#59

Post by pluma »

tomnipotent wrote: post #21
hn_throwaway_99 wrote: post #5

I wish companies would do away with the "leaving to pursue other opportunities" nonsense and just give no reasons if they don't want to discuss it. No C-level exec resigns "effective immediately" without either a transition plan in place or something concrete lined up. I get wanting to allow him to say he resigned instead of he was fired, but the silly language of the press release just makes it worse.

> I wish companies Because it's not a soap opera and you're not owed anything about the personal business of other people. As an individual, I have every right to control the narrative for why I've left a company (assuming nothing illegal).

Sure but at a certain point it just harms your credibility if instead of owning up to the incredibly bad mistakes you still pretend you're only leaving because the grass is greener elsewhere.

I know it's standard business procedure to outright lie about these things but it becomes farcical when you basically sink an entire company and then get to "resign" and pretend it's not because you did a terrible job.

Re: NPM CEO Bryan Bogensberger Resigned

#60

Post by josegonzalez »

president wrote: post #40
knightofmars wrote: post #33

Earlier quoted context omitted.

Yes. The Node ecosystem is a huge liability just waiting to happen. Any organization that depends on NPM is making a huge gamble. You can do a lot to mitigate this (private NPM repo, locks) but the reality is that the dependency chains are dangerous. Is someone in an organization going to audit all of those dependencies? Especially under the circumstances where they've been declared without an explicit version (>, >=…

As someone who has no insight into the Node/NPM/JS world, how is this different from Python's PyPi, which I would think suffers the same issue?

The number of packages you need to audit for what would otherwise seem to be a trivial feature is exponentially larger in JS world than in Python. A good example of that is the left-pad debacle, wherein a package that left-pads a string was taken down, causing other packages - notably React - to fail to be installed because of either direct or transitive dependencies.

In the Python world, it is indeed likely that unpublishing requests will cause issues, but the number of dependencies you'd need to audit/vendor is _much_ smaller for a typical python app than it is for a typical nodejs app, so your "attack surface" is also comparatively much smaller.

Post reply on HN