5 ms·

depending on npm is scary >.<

mastahmind 8y ago
well, you can look at it at both ways, if yarn just used npm's registry then there wouldn't be a problem. I am not sure what's their reason to add a registry (a mirror at that) if they don't plan to make their own.
- jessaustin 8y ago
  ISTM this was a marketing ploy for yarn. If CF could proxy npm's registry faster than npm could serve it directly, yarn could claim to be faster than npm. Even if the apps themselves had been identical, network speed is still speed. As we could expect for any competitive advantage that is purchased by one party, it has now been purchased by another party, so it ceases to be an advantage at all. The Red Queen lives!
  - andrewshifflett 8y ago
    CJ (CTO at npm) explained on Twitter why they switched to Cloudflare: https://twitter.com/ceejbot/status/1000230136900239360 https://twitter.com/ceejbot/status/1000230136900239360 (See: https://developers.cloudflare.com/workers/about/ https://developers.cloudflare.com/workers/about/)
- asadlionpk 8y ago
  Maybe future proofing? They can always make their own and just point CNAME to the new registry?
moojd 8y ago
I think it's probably a good idea to run your own proxy/mirror of whatever package registry your language uses if you heavily depend on it being available. We proxy packagist at work, I'm starting to think we should do the same with npm. Has anyone here had success with any out of the box solutions?
- Silhouette 8y ago
  Has anyone here had success with any out of the box solutions? No, but we have had multiple failures with various tools when attempts to remove the remote dependencies came into conflict with not particularly unusual real world requirements. This is a pretty serious flaw in the JS ecosystem right now. Unfortunately I can't offer much constructive advice here. We have found no good solution so far that doesn't have significant limitations, except in the case that all of your developers are in the same place and you are willing to literally clone the entire thing also in the same place, have everyone use that one clone, and incorporate the necessary maintenance work into your processes (which is a viable if somewhat awkward strategy if these constraints are acceptable in your situation).
- manyxcxi 8y ago
  We use Sonatype Nexus OSS to host private as well as mirror public Maven, npm, and Docker repositories. It took a small amount of fiddling but in less than a day we were up and running, using our LDAP for auth, and it’s been pretty much trouble free from the get go. In fact, we even use it to host our own completely custom internal package system (based on Ivy) for our content packages and database modules. It’s been a huge boon to us. Artifactory is another competitor but last I checked npm and Docker registries required the paid version.
  - deleted 8y ago
    [deleted]
- TAForObvReasons 8y ago
  verdaccio for NPM is a breeze to set up: https://www.verdaccio.org/ https://www.verdaccio.org/
- doublerebel 8y ago
  Yes, I've been running smart-private-npm for years on Cloudant accounts. Works exactly like original npm, but more reliable. Glad to provide advice if you go that direction.

well, you can look at it at both ways, if yarn just used npm's registry then there wouldn't be a problem. I am not sure what's their reason to add a registry (a mirror at that) if they don't plan to make their own.

jessaustin 8y ago
ISTM this was a marketing ploy for yarn. If CF could proxy npm's registry faster than npm could serve it directly, yarn could claim to be faster than npm. Even if the apps themselves had been identical, network speed is still speed. As we could expect for any competitive advantage that is purchased by one party, it has now been purchased by another party, so it ceases to be an advantage at all. The Red Queen lives!
- andrewshifflett 8y ago
  CJ (CTO at npm) explained on Twitter why they switched to Cloudflare: https://twitter.com/ceejbot/status/1000230136900239360 https://twitter.com/ceejbot/status/1000230136900239360 (See: https://developers.cloudflare.com/workers/about/ https://developers.cloudflare.com/workers/about/)
asadlionpk 8y ago
Maybe future proofing? They can always make their own and just point CNAME to the new registry?

moojd 8y ago

I think it's probably a good idea to run your own proxy/mirror of whatever package registry your language uses if you heavily depend on it being available. We proxy packagist at work, I'm starting to think we should do the same with npm. Has anyone here had success with any out of the box solutions?

Silhouette 8y ago
Has anyone here had success with any out of the box solutions? No, but we have had multiple failures with various tools when attempts to remove the remote dependencies came into conflict with not particularly unusual real world requirements. This is a pretty serious flaw in the JS ecosystem right now. Unfortunately I can't offer much constructive advice here. We have found no good solution so far that doesn't have significant limitations, except in the case that all of your developers are in the same place and you are willing to literally clone the entire thing also in the same place, have everyone use that one clone, and incorporate the necessary maintenance work into your processes (which is a viable if somewhat awkward strategy if these constraints are acceptable in your situation).
manyxcxi 8y ago
We use Sonatype Nexus OSS to host private as well as mirror public Maven, npm, and Docker repositories. It took a small amount of fiddling but in less than a day we were up and running, using our LDAP for auth, and it’s been pretty much trouble free from the get go. In fact, we even use it to host our own completely custom internal package system (based on Ivy) for our content packages and database modules. It’s been a huge boon to us. Artifactory is another competitor but last I checked npm and Docker registries required the paid version.
- deleted 8y ago
  [deleted]
TAForObvReasons 8y ago
verdaccio for NPM is a breeze to set up: https://www.verdaccio.org/ https://www.verdaccio.org/
doublerebel 8y ago
Yes, I've been running smart-private-npm for years on Cloudant accounts. Works exactly like original npm, but more reliable. Glad to provide advice if you go that direction.