3 ms·

What replaces the npm registry, though? That's the reason that npm Inc. exists, not just stewardship of the CLI.

by tiles 9y ago

diggan 9y ago
A decentralized repository of packages that anyone can help out maintain. Not entirely sure how, but I think that would be the ideal scenario.
- mstade 9y ago
  Something like IPFS could perhaps be used for this. I think the biggest issue is probably access control. I.e. just releasing packages addressed by content isn't enough, because people generally depend on @whatever/left-pad and not 5b055a0b42f1c or whatever the hash may be. Real estate in a global name space means someone gets there first, so you'll need to consider how to deal with name squatters and the likes. With a centralized source like npm it's as easy as getting in touch with support (they're very good) but when no one knows the name space everyone owns the name space – makes it hard to make things "nice". So I guess what I'm saying is that just storage isn't the tricky bit to distribute really, but having a global namespace is I guess.
  - diggan 9y ago
    well, you could depend on left-pad@5b055a0b42f1c, and the name doesn't really matter. Normally you would include that as require('left-pad') but if you have multiple versions, I don't see why require('left-pad@5b055a0b42f1c') couldn't be used. There is a tool for doing this in Golang already[0] and I've also done some experiments to get this to work in JavaScript[1] - [0] https://github.com/whyrusleeping/gx https://github.com/whyrusleeping/gx - [1] http://everythingstays.com http://everythingstays.com
- ilaksh 9y ago
  Back when the npm registry was really struggling with reliability (I believe because it was secondary to profit for Joyent) I was saying we needed a decentralized registry solution. But right when that got some upvotes on r/node, within a few days isaacs had npm inc. going. And within a few weeks or months, the npm registry was pretty rock solid. And I have not had a single registry issue in forever. And npm 4 works well, and I'm sure npm@5 works even better. I still think it makes sense to have a decentralized repository and I guess its nice to have a non-commercial alternative to npm. But for me its not important anymore because npm is working really great now.
  - IsaacSchlueter 9y ago
    That's great to hear! Reliability sure was tough in those days. npm wasn't secondary or tertiary or any-ary to Joyent. It was my nights and weekends project the whole time I was there, and IrisCouch generously donated infrastructure, which we pushed to its very limit once Nodejitsu acquired them.
- 013a 9y ago
  Go does something like this, by referencing packages through Git url. Of course, 99% of packages you install are through Github, but that's not Go's fault. It has downsides, but its really a great and extensible system.
  - josh64 9y ago
    You can do the same thing with npm and yarn as well by referencing the git+https URL and a tag/branch/commit instead of a version number.

What replaces the npm registry, though? That's the reason that npm Inc. exists, not just stewardship of the CLI.

by tiles 9y ago

What replaces the npm registry, though? That's the reason that npm Inc. exists, not just stewardship of the CLI.

A decentralized repository of packages that anyone can help out maintain. Not entirely sure how, but I think that would be the ideal scenario.

mstade 9y ago
Something like IPFS could perhaps be used for this. I think the biggest issue is probably access control. I.e. just releasing packages addressed by content isn't enough, because people generally depend on @whatever/left-pad and not 5b055a0b42f1c or whatever the hash may be. Real estate in a global name space means someone gets there first, so you'll need to consider how to deal with name squatters and the likes. With a centralized source like npm it's as easy as getting in touch with support (they're very good) but when no one knows the name space everyone owns the name space – makes it hard to make things "nice". So I guess what I'm saying is that just storage isn't the tricky bit to distribute really, but having a global namespace is I guess.
- diggan 9y ago
  well, you could depend on left-pad@5b055a0b42f1c, and the name doesn't really matter. Normally you would include that as require('left-pad') but if you have multiple versions, I don't see why require('left-pad@5b055a0b42f1c') couldn't be used. There is a tool for doing this in Golang already[0] and I've also done some experiments to get this to work in JavaScript[1] - [0] https://github.com/whyrusleeping/gx https://github.com/whyrusleeping/gx - [1] http://everythingstays.com http://everythingstays.com
ilaksh 9y ago
Back when the npm registry was really struggling with reliability (I believe because it was secondary to profit for Joyent) I was saying we needed a decentralized registry solution. But right when that got some upvotes on r/node, within a few days isaacs had npm inc. going. And within a few weeks or months, the npm registry was pretty rock solid. And I have not had a single registry issue in forever. And npm 4 works well, and I'm sure npm@5 works even better. I still think it makes sense to have a decentralized repository and I guess its nice to have a non-commercial alternative to npm. But for me its not important anymore because npm is working really great now.
- IsaacSchlueter 9y ago
  That's great to hear! Reliability sure was tough in those days. npm wasn't secondary or tertiary or any-ary to Joyent. It was my nights and weekends project the whole time I was there, and IrisCouch generously donated infrastructure, which we pushed to its very limit once Nodejitsu acquired them.
013a 9y ago
Go does something like this, by referencing packages through Git url. Of course, 99% of packages you install are through Github, but that's not Go's fault. It has downsides, but its really a great and extensible system.
- josh64 9y ago
  You can do the same thing with npm and yarn as well by referencing the git+https URL and a tag/branch/commit instead of a version number.