3 ms·

This is so superficial. How can you talk about ecosystem fragility when NPM is one of the best open source companies and which actually cope with problems (unli

by iddan 8y ago

This is so superficial. How can you talk about ecosystem fragility when NPM is one of the best open source companies and which actually cope with problems (unlike most package registries who are completely passive)

cnorthwood 8y ago
The ecosystem is more than just NPM the company (or tool, or registry...). And I think the problem is far from superficial, if it was superficial it'd be trivial to fix. In theory the same applies to PyPI or Rubygems or whatever else you use too, but it's the fact that JavaScript packaging culture has grown to have many, small "does one thing well" packages that makes it harder to be across those which you are giving trust to.