4 ms·

So wait...if I depend on a package but the developer randomly wants to remove his work from the Internet and become a recluse, my entire site breaks? What if I

So wait...if I depend on a package but the developer randomly wants to remove his work from the Internet and become a recluse, my entire site breaks? What if I just don't want to be bothered anymore by having to rewrite entire modules I depended on? NPM jumped the shark a year or so ago. A package manager vitally depended on should be forced to work for free. We are all going to suffer from Isaac's leadership on NPM.

_Marak_ 11y ago
If you are depending on another persons package and haven't bothered to lock in a version or bundle the version into your application, your site is not your site. If you want to depend on other's peoples work without taking care to insulate yourself, you'll have to deal with it. Why is it none of my applications were affected by `left-pad` this week? Good question. NPM had plenty of chances for realistic ( non-venture capital based ) funding. They took too much cash and hired too many people. Now everything is starting to fall apart.
- gkoberger 11y ago
  So, if you're okay with me locking a package myself... why can't NPM just do the locking for me? That's what's happening with this new change. After all, I'm not a developer because I like administrative work – I want to build stuff, and NPM takes the hassle out of this.
chris_wot 11y ago
Wow. Just wow. Before npm you'd grab a tarball and keep a copy in an external modules directory. If the author pulled their work, you'd keep using that tarball, and eventually migrate to another package. But agreed. Isaacs seems to do quite a few unilateral changes that cause a hell of a lot of disruption.
- _Marak_ 11y ago
  If you remember the actual history of NPM, you will remember that TJ had a competing package manager called "kiwi" which was entirely github / git / and bash based ( using semver ). Nodejitsu ( me ) choose to back NPM over Kiwi starting in 2009. It's all public information if you start crawling through emails.
  - chris_wot 11y ago
    Should there be another package manager?
the_ancient 11y ago
If your site breaks because NPM is down, or a package is removed, you have designed your site poorly and you deserve to have your site taken down.

_Marak_ 11y ago

If you are depending on another persons package and haven't bothered to lock in a version or bundle the version into your application, your site is not your site. If you want to depend on other's peoples work without taking care to insulate yourself, you'll have to deal with it. Why is it none of my applications were affected by `left-pad` this week? Good question. NPM had plenty of chances for realistic ( non-venture capital based ) funding. They took too much cash and hired too many people. Now everything is starting to fall apart.

gkoberger 11y ago
So, if you're okay with me locking a package myself... why can't NPM just do the locking for me? That's what's happening with this new change. After all, I'm not a developer because I like administrative work – I want to build stuff, and NPM takes the hassle out of this.

chris_wot 11y ago

Wow. Just wow. Before npm you'd grab a tarball and keep a copy in an external modules directory. If the author pulled their work, you'd keep using that tarball, and eventually migrate to another package. But agreed. Isaacs seems to do quite a few unilateral changes that cause a hell of a lot of disruption.

_Marak_ 11y ago
If you remember the actual history of NPM, you will remember that TJ had a competing package manager called "kiwi" which was entirely github / git / and bash based ( using semver ). Nodejitsu ( me ) choose to back NPM over Kiwi starting in 2009. It's all public information if you start crawling through emails.
- chris_wot 11y ago
  Should there be another package manager?

the_ancient 11y ago

If your site breaks because NPM is down, or a package is removed, you have designed your site poorly and you deserve to have your site taken down.