Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NPM CEO Bryan Bogensberger Resigned

prnewswire.com

Post reply on HN
Print view View original

61–70 of 108 posts

Re: NPM CEO Bryan Bogensberger Resigned

#61

Post by takeda »

president wrote: post #40
knightofmars wrote: post #33

Earlier quoted context omitted.

Yes. The Node ecosystem is a huge liability just waiting to happen. Any organization that depends on NPM is making a huge gamble. You can do a lot to mitigate this (private NPM repo, locks) but the reality is that the dependency chains are dangerous. Is someone in an organization going to audit all of those dependencies? Especially under the circumstances where they've been declared without an explicit version (>, >=…

As someone who has no insight into the Node/NPM/JS world, how is this different from Python's PyPi, which I would think suffers the same issue?

I think the problem is that NodeJS has a weird culture where a separate package is created for every little thing, then tons of other packages start depending on it.

I don't live in NodeJS world but even I heard about package Left-Pad, that all it does is padding string from the left side. The author decided to pull it out from the repo rendering tons of other packages nonoperational[1].

[1] https://www.theregister.co.uk/2016/03/23/npm_left_pad_chaos/

Re: NPM CEO Bryan Bogensberger Resigned

#62

Post by montecarl »

president wrote: post #40
knightofmars wrote: post #33

Earlier quoted context omitted.

Yes. The Node ecosystem is a huge liability just waiting to happen. Any organization that depends on NPM is making a huge gamble. You can do a lot to mitigate this (private NPM repo, locks) but the reality is that the dependency chains are dangerous. Is someone in an organization going to audit all of those dependencies? Especially under the circumstances where they've been declared without an explicit version (>, >=…

As someone who has no insight into the Node/NPM/JS world, how is this different from Python's PyPi, which I would think suffers the same issue?

A large Python package might have fewer than 10 dependencies, while a typical JS package easily has hundreds if not thousands of dependencies. Its much easier to manage your dependencies when you can count them on your fingers.

Re: NPM CEO Bryan Bogensberger Resigned

#63

Post by Ididntdothis »

trakter wrote: post #17
dopamean wrote: post #12

Earlier quoted context omitted.

This is my favorite excuse in sports because they "retiree" almost always comes back out of retirement which leads me to believe they've had enough time with their family.

Nico Rosberg, springs to mind. Not racing again, but he does like to show his face at the races a lot.

I think there is something to it but I think being a driver, especially as Hamilton's teammate, is all-consuming and super stressful. I think now he can do what he wants when he wants without much pressure. He seems to enjoy the spotlight so that's what he does.

Re: NPM CEO Bryan Bogensberger Resigned

#64

Post by pluma »

cjblomqvist wrote: post #42
asien wrote: post #18

I’m fascinated by the fact that while node has become a new standard in the industry , and the project is receiving lots of supports from all sorts of companies ( IBM , Microsoft etc...) absolutely no discussion has been opened about how much at risk the JavaScript ecosystem actually is with « npm » and it’s weekly dramas Not a month pass without something going wrong inside of inc, millions of developers are dependa…

Honest question, is it that much better in other communities? In particular, it's there anything inherent to npm that's problematic or is it just that a huge community with a Unix mindset (small packages that does one thing well) is problematic?

No other package manager is run by a VC backed startup. That's inherently problematic and means the registry is in the hands of a company that could be killed off or sold at any moment because it needs to make massive profits (without having any way to truly make a profit in the first place) to continue to exist.

Re: NPM CEO Bryan Bogensberger Resigned

#65

Post by thrower123 »

president wrote: post #40
knightofmars wrote: post #33

Earlier quoted context omitted.

Yes. The Node ecosystem is a huge liability just waiting to happen. Any organization that depends on NPM is making a huge gamble. You can do a lot to mitigate this (private NPM repo, locks) but the reality is that the dependency chains are dangerous. Is someone in an organization going to audit all of those dependencies? Especially under the circumstances where they've been declared without an explicit version (>, >=…

As someone who has no insight into the Node/NPM/JS world, how is this different from Python's PyPi, which I would think suffers the same issue?

Python has a standard library that is not horribly anemic, and, as far as I know, there isn't anywhere near the same propensity to atomize packages. NPM is infamous for having stupidly small packages like isEven or leftPad, and monstrous transitive dependency trees.

Re: NPM CEO Bryan Bogensberger Resigned

#66

Post by torben-friis »

cjblomqvist wrote: post #42
asien wrote: post #18

I’m fascinated by the fact that while node has become a new standard in the industry , and the project is receiving lots of supports from all sorts of companies ( IBM , Microsoft etc...) absolutely no discussion has been opened about how much at risk the JavaScript ecosystem actually is with « npm » and it’s weekly dramas Not a month pass without something going wrong inside of inc, millions of developers are dependa…

Honest question, is it that much better in other communities? In particular, it's there anything inherent to npm that's problematic or is it just that a huge community with a Unix mindset (small packages that does one thing well) is problematic?

Lack of a large enough standard library is a big differenciating factor, as it makes you very dependent on third party libraries.

Even if you avoid it by creating your own utils, chances are that the creators of the large packages you use (like a database manager or a rest framework) will depend directly or indirectly of those third party tools.

Re: NPM CEO Bryan Bogensberger Resigned

#67

Post by Bartweiss »

president wrote: post #40
knightofmars wrote: post #33

Earlier quoted context omitted.

Yes. The Node ecosystem is a huge liability just waiting to happen. Any organization that depends on NPM is making a huge gamble. You can do a lot to mitigate this (private NPM repo, locks) but the reality is that the dependency chains are dangerous. Is someone in an organization going to audit all of those dependencies? Especially under the circumstances where they've been declared without an explicit version (>, >=…

As someone who has no insight into the Node/NPM/JS world, how is this different from Python's PyPi, which I would think suffers the same issue?

Mechanically, I believe the main difference is that NPM corresponds to PyPi + pip; it's both registry and repository. PyPi is Python's official package repository and pip's default source, but it's not pip's only possible source. If someone pulls code off PyPi, pip can still link to it elsewhere.

When the left-pad debacle [1] broke major packages, the triggering event was that NPM-the-registry took a module name away from a developer and gave it to a company (which held it as a trademark). He got mad and took all his code off NPM-the-repository, including left-pad. To settle the chaos, NPM had to restore the deleted code against the developer's wishes - even though his code was still available on GitHub.

Realistically, though, that would still cause some chaos and it doesn't seem to be the key difference. The more important differences are legal and practical.

npm, inc. is a private company, while PyPi (via Warehouse) and pip are both open-source and donation funded. Even if npm doesn't get up to anything malicious, they depend on keeping their registry and repository unified, and they're more likely to attract and buckle under trademark suits than PyPi.

Even more importantly, npm modules are tiny. PyPi packages and Ruby gems may be single-purpose, but they usually do something which isn't completely trivial, and common functions like math libraries are built into larger packages. npm left-pad was 17 lines of string-padding code that almost anyone could write. Other modules are even sillier; isArray has millions of weekly downloads for what is effectively a single line of code. Blank npm templates have tens of thousands of files loaded even before you start coding.[2] So fundamentally, a big part of the issue is just that node projects tend to pull in 10x or 100x more dependencies than most other projects.

[1] https://www.theregister.co.uk/2016/03/23/npm_left_pad_chaos/

[2] https://www.davidhaney.io/npm-left-pad-have-we-forgotten-how...

Re: NPM CEO Bryan Bogensberger Resigned

#68

Post by [deleted] »

kanox wrote: post #57
cols wrote: post #46

Earlier quoted context omitted.

If the context is opaque to you then I would encourage you to read the articles and to read the other comments on this thread.

As far as I can tell a bunch of people are upset because they got fired - so what? Companies fire people all the time.

[deleted]

Re: NPM CEO Bryan Bogensberger Resigned

#69

Post by Bartweiss »

paulddraper wrote: post #44
tiborsaas wrote: post #32

Earlier quoted context omitted.

I don't think that's accurate. Most devs and thus companies treat NPM as a utility. Maybe very large companies would not feel it, but if NPM went down tomorrow there would be utter chaos on the internet.

There would be chaos, just not for FAANG.

Someone upthread asked "why is NPM different from PyPi/pip in this?"

There are lots of practical answers - PyPi is open source, Python packages aren't so fragmented, and so on. But honestly, a huge part of the difference is that PyPi has sponsors like PyPi and AWS using its baseline implementation. NPM's private repository system means the public system just doesn't have that kind of pressure on it.

Re: NPM CEO Bryan Bogensberger Resigned

#70

Post by asciident »

fharper wrote: post #47
sneak wrote: post #41

Earlier quoted context omitted.

Why was he asked to leave? To which “terrible optics” do you refer? Your implied context is opaque.

Here is some background on some of the things that happened while he was CEO: https://twitter.com/fharper/status/1111694552262459393

Maybe I didn't read too far into the thread, but it sounds like they laid off a guy, provided some severance, and there weren't many managers that sent him a goodbye note? I don't see the connection here... what was the bad thing they did?
Post reply on HN