4 ms·

It's noteworthy though that they were able to operate for 4 years with a small 8 million series A round. Since NPM is so essential to the Javascript ecosystem,

It's noteworthy though that they were able to operate for 4 years with a small 8 million series A round. Since NPM is so essential to the Javascript ecosystem, it's interesting to consider a hypothetical bankruptcy. I'm sure someone big would buy them, or they could pivot to a non profit with a crowd funding/donation based model.

paxys 8y ago
The ideal scenario would be NPM existing as a foundation rather than a for-profit company. The more likely one is them folding and Facebook taking over as the source of truth for JS packages, which is bad for everyone.
- the_duke 8y ago
  Agreed. Any kind of fork/split led by a company like Facebook would be highly controversial and come with lot's of drama. This would inevitably spark a non-profit community driven alternative and cause chaos. All outcomes would be very damaging to the JS ecosystem though. (also, I don't see FB having any interest in running the Javascript package registry. Yarn and it's proxy are really just a result of limitations and slowness of the official implementations)
- hnzix 8y ago
  It would be darkly hilarious if NPM gets bought out by a state actor, although Facebook would be nearly as bad.
  - TeMPOraL 8y ago
    Doubly hilarious if that state actor wasn't the US or one of its close allies.
larkeith 8y ago
As evv brought up [1], it's rather concerning that the cornerstone of the JS ecosystem is a for-profit organization (especially one lacking in a source of aforementioned profit). I wonder if their bankruptcy might not be the worst thing for the community, in the long term - it would certainly discourage relying on a single fallible repository in the future. [1] https://news.ycombinator.com/item?id=19725139 https://news.ycombinator.com/item?id=19725139
- the_duke 8y ago
  The only alternatives to a single source of truth repository are A) multiple large, competing repositories B) a distributed system like Go which relies on just a path to the source repository Both of those suck. A) is messy and confusing, B) has a whole host of problems (no immutability, no reliability and assurance that the code will be here tomorrow, mandatory vendoring, ....). Sure, a community driven non profit foundation in charge would be ideal, but a single source of truth, even if for profit, is much better than the alternatives.
  - 13rac1 8y ago
    I strongly prefer Go's "option B" over node_modules. Your concerns (immutability, reliability, and general code existence) are handled by vendoring. Vendoring has the added benefit of enabling project builds without additional HTTP dependencies; entirely avoiding the "left-pad" problem class. I wish my NPM projects were so easy.
  - _jal 8y ago
    There are other models. CPAN, for instance, has worked incredibly well for its audience for 25 years and counting. https://www.cpan.org https://www.cpan.org
    - the_duke 8y ago
      But, unless I'm missing something, CPAN is a centralized registry, just like npm?
      - y4mi 8y ago
        > The master CPAN site is hosted by Phyber in Los Angeles, Agreed. Maybe he meant the mirrors and how you could use them interchangeably? But that would be strange too, considering it's just as easy to create your own npm mirror as well
      - _jal 8y ago
        I was more getting at the governance model. You didn't say this, but the direction of the discussion seemed to be that centralized metadata == for-profit.
pryce 8y ago
We already know that maintainers of widely-used NPM packages are being approached and offered money by people with dubious intentions. I may not agree with many of NPM's decisions, but NPM does fall over and a malicious party takes it over its functions, web development is looking at a security catastrophe. If the financial incentive for malicious actors is already represents an issue today in that there are attempts to gain control of numerous packages, imagine what the combined financial incentive would be to take over the whole index.
- chongli 8y ago
  web development is looking at a security catastrophe Which in the long run should highlight the dangers of centralization with a single point of failure. We need to move back toward a decentralized web!
  - acct1771 8y ago
    Couldn't hear you over my gig of Google Fonts downloading, one more time?

paxys 8y ago

The ideal scenario would be NPM existing as a foundation rather than a for-profit company. The more likely one is them folding and Facebook taking over as the source of truth for JS packages, which is bad for everyone.

the_duke 8y ago
Agreed. Any kind of fork/split led by a company like Facebook would be highly controversial and come with lot's of drama. This would inevitably spark a non-profit community driven alternative and cause chaos. All outcomes would be very damaging to the JS ecosystem though. (also, I don't see FB having any interest in running the Javascript package registry. Yarn and it's proxy are really just a result of limitations and slowness of the official implementations)
hnzix 8y ago
It would be darkly hilarious if NPM gets bought out by a state actor, although Facebook would be nearly as bad.
- TeMPOraL 8y ago
  Doubly hilarious if that state actor wasn't the US or one of its close allies.

larkeith 8y ago

As evv brought up [1], it's rather concerning that the cornerstone of the JS ecosystem is a for-profit organization (especially one lacking in a source of aforementioned profit). I wonder if their bankruptcy might not be the worst thing for the community, in the long term - it would certainly discourage relying on a single fallible repository in the future. [1] https://news.ycombinator.com/item?id=19725139 https://news.ycombinator.com/item?id=19725139

the_duke 8y ago
The only alternatives to a single source of truth repository are A) multiple large, competing repositories B) a distributed system like Go which relies on just a path to the source repository Both of those suck. A) is messy and confusing, B) has a whole host of problems (no immutability, no reliability and assurance that the code will be here tomorrow, mandatory vendoring, ....). Sure, a community driven non profit foundation in charge would be ideal, but a single source of truth, even if for profit, is much better than the alternatives.
- 13rac1 8y ago
  I strongly prefer Go's "option B" over node_modules. Your concerns (immutability, reliability, and general code existence) are handled by vendoring. Vendoring has the added benefit of enabling project builds without additional HTTP dependencies; entirely avoiding the "left-pad" problem class. I wish my NPM projects were so easy.
- _jal 8y ago
  There are other models. CPAN, for instance, has worked incredibly well for its audience for 25 years and counting. https://www.cpan.org https://www.cpan.org
  - the_duke 8y ago
    But, unless I'm missing something, CPAN is a centralized registry, just like npm?
    - y4mi 8y ago
      > The master CPAN site is hosted by Phyber in Los Angeles, Agreed. Maybe he meant the mirrors and how you could use them interchangeably? But that would be strange too, considering it's just as easy to create your own npm mirror as well
    - _jal 8y ago
      I was more getting at the governance model. You didn't say this, but the direction of the discussion seemed to be that centralized metadata == for-profit.

pryce 8y ago

We already know that maintainers of widely-used NPM packages are being approached and offered money by people with dubious intentions. I may not agree with many of NPM's decisions, but NPM does fall over and a malicious party takes it over its functions, web development is looking at a security catastrophe. If the financial incentive for malicious actors is already represents an issue today in that there are attempts to gain control of numerous packages, imagine what the combined financial incentive would be to take over the whole index.

chongli 8y ago
web development is looking at a security catastrophe Which in the long run should highlight the dangers of centralization with a single point of failure. We need to move back toward a decentralized web!
- acct1771 8y ago
  Couldn't hear you over my gig of Google Fonts downloading, one more time?