3 ms·

Can you explain why the lack of a central package repository is an issue? All of the languages I use in my daily work have central package repositories, but I

Can you explain why the lack of a central package repository is an issue? All of the languages I use in my daily work have central package repositories, but I don't use them for discovery, I use google, GitHub, etc., because to feel comfortable using a package I need to answer some meta-questions about the package ("is this package used by a lot of people?", "is it updated frequently?", "are there are a lot of reported issues and do the owners respond to issues diligently?") It seems to me that while I'm on the GitHub page anyway, it's reasonably convenient to just copy-paste the URL in a file so I can pull in the package and use it. I can't imagine just using a package repo for discovering new packages, that would be tantamount to just pulling whatever random code someone wrote that looks like it might solve my problem.

steveklabnik 10y ago
One small example: someone could delete that github repository, and you'd be hosed. But many centralized systems (like crates.io) do not let you remove packages. The only way that things accidentally break there is if the government gets involved.
- theseoafs 10y ago
  That's certainly true -- unrelated to the discovery point I mentioned, but it is true. The different tradeoffs are well-understood at this point IMO.
- themihai 10y ago
  As a package user you could use your own git mirroring server or just use a fork. Even simpler just vendor it and you are safe from package removal. On the other hand a central distribution model is more problematic. As package author I want a certain degree of control over my code. If crates.io gets compromissed or is down everyone suffers. If crates.io received a DMCA(happened on npm) my package can be removed. I put some effort into that package so if for some reasons I want to remove it it should be my choice. Why do want to keep it hostage if it's not yours? I though at leat Mozilla learned that distributed is better than centralized. Do you want a place to find all the rust packages? Make a search engine(see godoc.org). Less is more!
  - steveklabnik 10y ago
    Sure, those are all various options. I was replying specifically to "why not GitHub".
bbatha 10y ago
I made some arguments about this in another place in the thread: https://news.ycombinator.com/item?id=12188869 https://news.ycombinator.com/item?id=12188869

steveklabnik 10y ago

One small example: someone could delete that github repository, and you'd be hosed. But many centralized systems (like crates.io) do not let you remove packages. The only way that things accidentally break there is if the government gets involved.

theseoafs 10y ago
That's certainly true -- unrelated to the discovery point I mentioned, but it is true. The different tradeoffs are well-understood at this point IMO.
themihai 10y ago
As a package user you could use your own git mirroring server or just use a fork. Even simpler just vendor it and you are safe from package removal. On the other hand a central distribution model is more problematic. As package author I want a certain degree of control over my code. If crates.io gets compromissed or is down everyone suffers. If crates.io received a DMCA(happened on npm) my package can be removed. I put some effort into that package so if for some reasons I want to remove it it should be my choice. Why do want to keep it hostage if it's not yours? I though at leat Mozilla learned that distributed is better than centralized. Do you want a place to find all the rust packages? Make a search engine(see godoc.org). Less is more!
- steveklabnik 10y ago
  Sure, those are all various options. I was replying specifically to "why not GitHub".

bbatha 10y ago

I made some arguments about this in another place in the thread: https://news.ycombinator.com/item?id=12188869 https://news.ycombinator.com/item?id=12188869