3 ms·

I agree on them not doing much. As in not much at all to help. How about I just go ask for every package on NPM and see who's busy enough to deal with that or n

• yazboo 8y ago
  Could you not do that on PyPi and rubygems as well?
  • doublerebel 8y ago
    Absolutely not. PyPi and Rubygems have much more strict and sane ownership policies to prevent unauthorized takeovers of packages. (Same with apt and every other major package repo.) No package in any package manager, if it contains code, and greater than 0 downloads and dependencies, should ever be replaced. The cost of storing an old package is miniscule compared to a system where anyone can petition for a package name takeover and cause unlimited cost through the effects of takeover. 30 days is absurdly short in the lifetime of software and does nothing good for the community. Package squatting is not a real problem for anyone. In this case, the owner wanted the ownership change so it's really a non-event.
    • krainboltgreene 8y ago
      > Rubygems have much more strict and sane ownership policies to prevent unauthorized takeovers of packages No we don't. Our process is just as secure as npm's. Please stop talking about things you don't actually know.
• krapp 8y ago
  Yeah, it's unfortunate that the entire Javascript ecosystem is inextricably wedded to a single company's registry and package manager but what can you do? We all just have to put up with it, I guess.