6 ms·

NPM staff fired after trying to unionize – complaints

206 points by adamnemecek 8y ago

paxys 8y ago
NPM Inc. last raised a Series A round in April 2015. Now, 4 years later, they still have no business model, no revenue and no more funding. Even in their very limited space there are competitors that perform better (Yarn). At this point it's clear that a union isn't going to save NPM. The company is really in no position to guarantee anyone anything.
- VonGuard 8y ago
  I was shocked to see CJ was terminated. When I heard that, I knew NPM was over. She's brilliant, and the idea of them throwing her overboard is a sure indication that they're doomed. It's like the Angels firing Mike Trout, the Warriors laying off Steph Curry, or someone firing Tiger Woods. It's a total sign of NPM giving up.
- the_duke 8y ago
  It's noteworthy though that they were able to operate for 4 years with a small 8 million series A round. Since NPM is so essential to the Javascript ecosystem, it's interesting to consider a hypothetical bankruptcy. I'm sure someone big would buy them, or they could pivot to a non profit with a crowd funding/donation based model.
  - paxys 8y ago
    The ideal scenario would be NPM existing as a foundation rather than a for-profit company. The more likely one is them folding and Facebook taking over as the source of truth for JS packages, which is bad for everyone.
    - the_duke 8y ago
      Agreed. Any kind of fork/split led by a company like Facebook would be highly controversial and come with lot's of drama. This would inevitably spark a non-profit community driven alternative and cause chaos. All outcomes would be very damaging to the JS ecosystem though. (also, I don't see FB having any interest in running the Javascript package registry. Yarn and it's proxy are really just a result of limitations and slowness of the official implementations)
    - hnzix 8y ago
      It would be darkly hilarious if NPM gets bought out by a state actor, although Facebook would be nearly as bad.
      - TeMPOraL 8y ago
        Doubly hilarious if that state actor wasn't the US or one of its close allies.
  - larkeith 8y ago
    As evv brought up [1], it's rather concerning that the cornerstone of the JS ecosystem is a for-profit organization (especially one lacking in a source of aforementioned profit). I wonder if their bankruptcy might not be the worst thing for the community, in the long term - it would certainly discourage relying on a single fallible repository in the future. [1] https://news.ycombinator.com/item?id=19725139 https://news.ycombinator.com/item?id=19725139
    - the_duke 8y ago
      The only alternatives to a single source of truth repository are A) multiple large, competing repositories B) a distributed system like Go which relies on just a path to the source repository Both of those suck. A) is messy and confusing, B) has a whole host of problems (no immutability, no reliability and assurance that the code will be here tomorrow, mandatory vendoring, ....). Sure, a community driven non profit foundation in charge would be ideal, but a single source of truth, even if for profit, is much better than the alternatives.
      - 13rac1 8y ago
        I strongly prefer Go's "option B" over node_modules. Your concerns (immutability, reliability, and general code existence) are handled by vendoring. Vendoring has the added benefit of enabling project builds without additional HTTP dependencies; entirely avoiding the "left-pad" problem class. I wish my NPM projects were so easy.
      - _jal 8y ago
        There are other models. CPAN, for instance, has worked incredibly well for its audience for 25 years and counting. https://www.cpan.org https://www.cpan.org
        the_duke 8y ago
        But, unless I'm missing something, CPAN is a centralized registry, just like npm?
  - pryce 8y ago
    We already know that maintainers of widely-used NPM packages are being approached and offered money by people with dubious intentions. I may not agree with many of NPM's decisions, but NPM does fall over and a malicious party takes it over its functions, web development is looking at a security catastrophe. If the financial incentive for malicious actors is already represents an issue today in that there are attempts to gain control of numerous packages, imagine what the combined financial incentive would be to take over the whole index.
    - chongli 8y ago
      web development is looking at a security catastrophe Which in the long run should highlight the dangers of centralization with a single point of failure. We need to move back toward a decentralized web!
      - acct1771 8y ago
        Couldn't hear you over my gig of Google Fonts downloading, one more time?
- larkeith 8y ago
  A union might not save NPM, but mistreating their employees is a surefire way to guarantee failure.
  - gridlockd 8y ago
    That's something you want to believe, but it's not true. Lots of companies that have abusive practices are trucking along just fine. Selectively firing people may actually improve morale for the obedient types. Think about it, you follow all the written and unwritten rules, you always step back, you don't cause dissent - what do you get in return? Well, you don't get fired. But if nobody ever gets fired for these reasons, you're going to feel like a sucker. In the US there's still this myth of the "disruptive innovator" who naturally breaks all the rules and yet redeems himself as a worker unit, despite all the issues they're causing. In Japan or Korea by contrast, none of this would fly. Obedience is a must. There's no space for disruption. Would you deny the success of Korean or Japanese businesses?
    - TeMPOraL 8y ago
      > That's something you want to believe, but it's not true. Lots of companies that have abusive practices are trucking along just fine. Indeed. And it's much worse outside our industry. Hearing stories from friends and family who work regular jobs (i.e. not specialized, well-paid, in high demand) is what makes me convinced unions are a must.
- javagram 8y ago
  I thought their business model was supposed to be private repository hosting. That said, with the existence of Verdaccio allowing companies to run private repositories within the firewall and at no cost beyond infrastructure, who is paying for private npm?
  - gedy 8y ago
    It (npm's) was really quite expensive last we looked, at least for our devs.
    - M2Ys4U 8y ago
      If my company's slack is anything to go by, the user administration processes leaves a lot to be desired as well.
- krainboltgreene 8y ago
  Two things: It's npm Inc and yarn isn't a competitor to npm Inc. It's at best an alternative to the npm cli client.
qmanjamz 8y ago
It's pretty shoddy journalism for the title of the article to assert this as fact even though it's just an allegation that hasn't even been investigated yet.
- cjbprime 8y ago
  But they did investigate. They interviewed sources who confirmed that unionizing was planned before people were fired, which is the title. And they read the lawsuit and talked to the lawyers, who obviously said the same thing.
  - qmanjamz 8y ago
    The title allows the reader to infer a causation that hasn't been proven or investigated. Given that the people making the allegation are bitter ex-employees who have a financial incentive for it to be true, it's an allegation that should be met with a healthy dose of skepticism. You probably don't see the bias in the article because you support unionization. If the article was instead titled "Sexual harassment complaints double after NPM staff unionize," you'd probably be complaining about bias the same as I am.
    - bartread 8y ago
      > You probably don't see the bias in the article because you support unionization. Erm, yeah, I'm not sure where to begin with this other than a "people in glass houses" style comment. I don't support unionization, for at least a couple of reasons[1], yet I still can't see where you're coming from with these assertions. [1] I don't think either is relevant to this discussion.
- dang 8y ago
  Could you please stop posting unsubstantive and/or uncivil comments so we don't have to ban you again?
evv 8y ago
All of the drama around the npm firings has sparked an interesting discussion in the JS community: does it even make sense to trust a for-profit corporation with the world's supply of JS? One of the creators of unpkg.com is considering a fork of the registry: https://twitter.com/mjackson/status/1119355707055165441 https://twitter.com/mjackson/status/1119355707055165441 Meanwhile, yarn (a popular alternative to the npm client), uses a proxy to NPM so they can change the default registry of all yarn clients, if they choose to. As it stands, npm is the centralized source of truth for all our JS packages, and historical versions. We have no guarantees about the future of npm. Aside from a relatively clean history, we have no reason to trust them. For every dollar of VC money that they have taken, we have a reason to believe the registry won't last in its current form. This is scary.
- bellerose 8y ago
  I always star the main packages I use on GitHub but I realize I'm missing out on the required packages being used as well. It would be nice if an alternative sprung up that was p2p truly decentralized by developers and intertwined with where developers typically host their repositories.
  - insertnickname 8y ago
    What does starring on GitHub accomplish? Isn't it just like a bookmark?
    - manigandham 8y ago
      It's sometimes used as a proxy to signal how "important" and "popular" something is.
- garkin 8y ago
  "Potential threat" trading in modern world is ridiculous. Why doesn't it smell ultra iatrogenic for anyone?
  - debacle 8y ago
eberkund 8y ago
I was doing some research recently on various private NPM registry implementations. My company wanted a way to share internal libraries and frontend apps in their local network. I was surprised to find out how poor most of the options were. I ended up settling on Azure DevOps (self-hosted) but an open-source fork of NPM wouldn't be the worst thing in the world. If the infrastructure went down tomorrow I'm sure most people could switch to Yarn without too much trouble.
- ssalka 8y ago
  >If the infrastructure went down tomorrow I'm sure most people could switch to Yarn without too much trouble. Generally true, except in the case of private scoped NPM packages. AFAIK if you want to switch to the yarn registry then you need to add exceptions that map your scoped package names to repositories that you host elsewhere.
  - krainboltgreene 8y ago
    There's no such thing as a yarn registry. The uri is just a CNAME to npm Inc.
- doublerebel 8y ago
  smart-private-npm is nearly API-compatible, I've been using it for years.
- krainboltgreene 8y ago
  If npm is down, so is yarn. Yarn's registry url is just a CNAME to npm Inc's registry.
fuck_npm 8y ago
Good. Fuck all of JavaScript. Burn it to the fucking ground. Throw all of this shit in the trash. It is useless. It is disgusting. JavaScript is worse than Flash, worse than PHP, worse than Cold Fusion. This internet is a terrible place, and it is because JavaScript being used for all kinds of bullshit on nearly every machine connected to the internet, and nothing new has happened inside web browsers since 1999.
mlindner 8y ago
Good on NPM for firing them. A union would have killed them.
bithavoc 8y ago
Wow, the Nodejitsu vs NPM, Inc drama[0] was nothing compared to this. Why isn't the Node.js foundation managing the registry? [0]https://gist.github.com/mikeal/9242748 https://gist.github.com/mikeal/9242748
tuananh 8y ago
i know running a registry isn't easy. i was wondering can github handle this kind of thing as backbone of a registry?
- javagram 8y ago
  I think CocoaPods used GitHub as their backbone. 2016: https://news.ycombinator.com/item?id=11245652 https://news.ycombinator.com/item?id=11245652
james621lara 8y ago
Thanks For sharing this information. It’s Nice..!!! https://games.lol/ https://games.lol/
james621lara 8y ago
This is a great post. I like this topic. https://games.lol/ https://games.lol/
pavlov 8y ago
I think Microsoft will step in and buy NPM Inc. It’s such an obvious ecosystem complement to Github and the Atom+VSCode editors they already own. They’re probably just waiting for a better price when the VCs on NPM’s board get impatient.

206 points by adamnemecek 8y ago

NPM Inc. last raised a Series A round in April 2015. Now, 4 years later, they still have no business model, no revenue and no more funding. Even in their very limited space there are competitors that perform better (Yarn). At this point it's clear that a union isn't going to save NPM. The company is really in no position to guarantee anyone anything.

VonGuard 8y ago
I was shocked to see CJ was terminated. When I heard that, I knew NPM was over. She's brilliant, and the idea of them throwing her overboard is a sure indication that they're doomed. It's like the Angels firing Mike Trout, the Warriors laying off Steph Curry, or someone firing Tiger Woods. It's a total sign of NPM giving up.
the_duke 8y ago
It's noteworthy though that they were able to operate for 4 years with a small 8 million series A round. Since NPM is so essential to the Javascript ecosystem, it's interesting to consider a hypothetical bankruptcy. I'm sure someone big would buy them, or they could pivot to a non profit with a crowd funding/donation based model.
- paxys 8y ago
  The ideal scenario would be NPM existing as a foundation rather than a for-profit company. The more likely one is them folding and Facebook taking over as the source of truth for JS packages, which is bad for everyone.
  - the_duke 8y ago
    Agreed. Any kind of fork/split led by a company like Facebook would be highly controversial and come with lot's of drama. This would inevitably spark a non-profit community driven alternative and cause chaos. All outcomes would be very damaging to the JS ecosystem though. (also, I don't see FB having any interest in running the Javascript package registry. Yarn and it's proxy are really just a result of limitations and slowness of the official implementations)
  - hnzix 8y ago
    It would be darkly hilarious if NPM gets bought out by a state actor, although Facebook would be nearly as bad.
    - TeMPOraL 8y ago
      Doubly hilarious if that state actor wasn't the US or one of its close allies.
- larkeith 8y ago
  As evv brought up [1], it's rather concerning that the cornerstone of the JS ecosystem is a for-profit organization (especially one lacking in a source of aforementioned profit). I wonder if their bankruptcy might not be the worst thing for the community, in the long term - it would certainly discourage relying on a single fallible repository in the future. [1] https://news.ycombinator.com/item?id=19725139 https://news.ycombinator.com/item?id=19725139
  - the_duke 8y ago
    The only alternatives to a single source of truth repository are A) multiple large, competing repositories B) a distributed system like Go which relies on just a path to the source repository Both of those suck. A) is messy and confusing, B) has a whole host of problems (no immutability, no reliability and assurance that the code will be here tomorrow, mandatory vendoring, ....). Sure, a community driven non profit foundation in charge would be ideal, but a single source of truth, even if for profit, is much better than the alternatives.
    - 13rac1 8y ago
      I strongly prefer Go's "option B" over node_modules. Your concerns (immutability, reliability, and general code existence) are handled by vendoring. Vendoring has the added benefit of enabling project builds without additional HTTP dependencies; entirely avoiding the "left-pad" problem class. I wish my NPM projects were so easy.
    - _jal 8y ago
      There are other models. CPAN, for instance, has worked incredibly well for its audience for 25 years and counting. https://www.cpan.org https://www.cpan.org
      - the_duke 8y ago
        But, unless I'm missing something, CPAN is a centralized registry, just like npm?
- pryce 8y ago
  We already know that maintainers of widely-used NPM packages are being approached and offered money by people with dubious intentions. I may not agree with many of NPM's decisions, but NPM does fall over and a malicious party takes it over its functions, web development is looking at a security catastrophe. If the financial incentive for malicious actors is already represents an issue today in that there are attempts to gain control of numerous packages, imagine what the combined financial incentive would be to take over the whole index.
  - chongli 8y ago
    web development is looking at a security catastrophe Which in the long run should highlight the dangers of centralization with a single point of failure. We need to move back toward a decentralized web!
    - acct1771 8y ago
      Couldn't hear you over my gig of Google Fonts downloading, one more time?
larkeith 8y ago
A union might not save NPM, but mistreating their employees is a surefire way to guarantee failure.
- gridlockd 8y ago
  That's something you want to believe, but it's not true. Lots of companies that have abusive practices are trucking along just fine. Selectively firing people may actually improve morale for the obedient types. Think about it, you follow all the written and unwritten rules, you always step back, you don't cause dissent - what do you get in return? Well, you don't get fired. But if nobody ever gets fired for these reasons, you're going to feel like a sucker. In the US there's still this myth of the "disruptive innovator" who naturally breaks all the rules and yet redeems himself as a worker unit, despite all the issues they're causing. In Japan or Korea by contrast, none of this would fly. Obedience is a must. There's no space for disruption. Would you deny the success of Korean or Japanese businesses?
  - TeMPOraL 8y ago
    > That's something you want to believe, but it's not true. Lots of companies that have abusive practices are trucking along just fine. Indeed. And it's much worse outside our industry. Hearing stories from friends and family who work regular jobs (i.e. not specialized, well-paid, in high demand) is what makes me convinced unions are a must.
javagram 8y ago
I thought their business model was supposed to be private repository hosting. That said, with the existence of Verdaccio allowing companies to run private repositories within the firewall and at no cost beyond infrastructure, who is paying for private npm?
- gedy 8y ago
  It (npm's) was really quite expensive last we looked, at least for our devs.
  - M2Ys4U 8y ago
    If my company's slack is anything to go by, the user administration processes leaves a lot to be desired as well.
krainboltgreene 8y ago
Two things: It's npm Inc and yarn isn't a competitor to npm Inc. It's at best an alternative to the npm cli client.

qmanjamz 8y ago

It's pretty shoddy journalism for the title of the article to assert this as fact even though it's just an allegation that hasn't even been investigated yet.

cjbprime 8y ago
But they did investigate. They interviewed sources who confirmed that unionizing was planned before people were fired, which is the title. And they read the lawsuit and talked to the lawyers, who obviously said the same thing.
- qmanjamz 8y ago
  The title allows the reader to infer a causation that hasn't been proven or investigated. Given that the people making the allegation are bitter ex-employees who have a financial incentive for it to be true, it's an allegation that should be met with a healthy dose of skepticism. You probably don't see the bias in the article because you support unionization. If the article was instead titled "Sexual harassment complaints double after NPM staff unionize," you'd probably be complaining about bias the same as I am.
  - bartread 8y ago
    > You probably don't see the bias in the article because you support unionization. Erm, yeah, I'm not sure where to begin with this other than a "people in glass houses" style comment. I don't support unionization, for at least a couple of reasons[1], yet I still can't see where you're coming from with these assertions. [1] I don't think either is relevant to this discussion.
dang 8y ago
Could you please stop posting unsubstantive and/or uncivil comments so we don't have to ban you again?

evv 8y ago

All of the drama around the npm firings has sparked an interesting discussion in the JS community: does it even make sense to trust a for-profit corporation with the world's supply of JS? One of the creators of unpkg.com is considering a fork of the registry: https://twitter.com/mjackson/status/1119355707055165441 https://twitter.com/mjackson/status/1119355707055165441 Meanwhile, yarn (a popular alternative to the npm client), uses a proxy to NPM so they can change the default registry of all yarn clients, if they choose to. As it stands, npm is the centralized source of truth for all our JS packages, and historical versions. We have no guarantees about the future of npm. Aside from a relatively clean history, we have no reason to trust them. For every dollar of VC money that they have taken, we have a reason to believe the registry won't last in its current form. This is scary.

bellerose 8y ago
I always star the main packages I use on GitHub but I realize I'm missing out on the required packages being used as well. It would be nice if an alternative sprung up that was p2p truly decentralized by developers and intertwined with where developers typically host their repositories.
- insertnickname 8y ago
  What does starring on GitHub accomplish? Isn't it just like a bookmark?
  - manigandham 8y ago
    It's sometimes used as a proxy to signal how "important" and "popular" something is.
garkin 8y ago
"Potential threat" trading in modern world is ridiculous. Why doesn't it smell ultra iatrogenic for anyone?
- debacle 8y ago

eberkund 8y ago

I was doing some research recently on various private NPM registry implementations. My company wanted a way to share internal libraries and frontend apps in their local network. I was surprised to find out how poor most of the options were. I ended up settling on Azure DevOps (self-hosted) but an open-source fork of NPM wouldn't be the worst thing in the world. If the infrastructure went down tomorrow I'm sure most people could switch to Yarn without too much trouble.

ssalka 8y ago
>If the infrastructure went down tomorrow I'm sure most people could switch to Yarn without too much trouble. Generally true, except in the case of private scoped NPM packages. AFAIK if you want to switch to the yarn registry then you need to add exceptions that map your scoped package names to repositories that you host elsewhere.
- krainboltgreene 8y ago
  There's no such thing as a yarn registry. The uri is just a CNAME to npm Inc.
doublerebel 8y ago
smart-private-npm is nearly API-compatible, I've been using it for years.
krainboltgreene 8y ago
If npm is down, so is yarn. Yarn's registry url is just a CNAME to npm Inc's registry.

fuck_npm 8y ago

Good. Fuck all of JavaScript. Burn it to the fucking ground. Throw all of this shit in the trash. It is useless. It is disgusting. JavaScript is worse than Flash, worse than PHP, worse than Cold Fusion. This internet is a terrible place, and it is because JavaScript being used for all kinds of bullshit on nearly every machine connected to the internet, and nothing new has happened inside web browsers since 1999.

mlindner 8y ago

Good on NPM for firing them. A union would have killed them.

bithavoc 8y ago

Wow, the Nodejitsu vs NPM, Inc drama[0] was nothing compared to this. Why isn't the Node.js foundation managing the registry? [0]https://gist.github.com/mikeal/9242748 https://gist.github.com/mikeal/9242748

tuananh 8y ago

i know running a registry isn't easy. i was wondering can github handle this kind of thing as backbone of a registry?

javagram 8y ago
I think CocoaPods used GitHub as their backbone. 2016: https://news.ycombinator.com/item?id=11245652 https://news.ycombinator.com/item?id=11245652

james621lara 8y ago

Thanks For sharing this information. It’s Nice..!!! https://games.lol/ https://games.lol/

james621lara 8y ago

This is a great post. I like this topic. https://games.lol/ https://games.lol/

pavlov 8y ago

I think Microsoft will step in and buy NPM Inc. It’s such an obvious ecosystem complement to Github and the Atom+VSCode editors they already own. They’re probably just waiting for a better price when the VCs on NPM’s board get impatient.