4 ms·

As evv brought up [1], it's rather concerning that the cornerstone of the JS ecosystem is a for-profit organization (especially one lacking in a source of afore

As evv brought up [1], it's rather concerning that the cornerstone of the JS ecosystem is a for-profit organization (especially one lacking in a source of aforementioned profit). I wonder if their bankruptcy might not be the worst thing for the community, in the long term - it would certainly discourage relying on a single fallible repository in the future. [1] https://news.ycombinator.com/item?id=19725139 https://news.ycombinator.com/item?id=19725139

the_duke 7y ago
The only alternatives to a single source of truth repository are A) multiple large, competing repositories B) a distributed system like Go which relies on just a path to the source repository Both of those suck. A) is messy and confusing, B) has a whole host of problems (no immutability, no reliability and assurance that the code will be here tomorrow, mandatory vendoring, ....). Sure, a community driven non profit foundation in charge would be ideal, but a single source of truth, even if for profit, is much better than the alternatives.
- 13rac1 7y ago
  I strongly prefer Go's "option B" over node_modules. Your concerns (immutability, reliability, and general code existence) are handled by vendoring. Vendoring has the added benefit of enabling project builds without additional HTTP dependencies; entirely avoiding the "left-pad" problem class. I wish my NPM projects were so easy.
- _jal 7y ago
  There are other models. CPAN, for instance, has worked incredibly well for its audience for 25 years and counting. https://www.cpan.org https://www.cpan.org
  - the_duke 7y ago
    But, unless I'm missing something, CPAN is a centralized registry, just like npm?
    - y4mi 7y ago
      > The master CPAN site is hosted by Phyber in Los Angeles, Agreed. Maybe he meant the mirrors and how you could use them interchangeably? But that would be strange too, considering it's just as easy to create your own npm mirror as well
    - _jal 7y ago
      I was more getting at the governance model. You didn't say this, but the direction of the discussion seemed to be that centralized metadata == for-profit.
- TeMPOraL 7y ago
  C) Content addressing, Torrent/IPFS style. JS devs keep downloading and redownloading the same stuff all over again, all the time; maybe it's time they gave some bandwidth back.

the_duke 7y ago

The only alternatives to a single source of truth repository are A) multiple large, competing repositories B) a distributed system like Go which relies on just a path to the source repository Both of those suck. A) is messy and confusing, B) has a whole host of problems (no immutability, no reliability and assurance that the code will be here tomorrow, mandatory vendoring, ....). Sure, a community driven non profit foundation in charge would be ideal, but a single source of truth, even if for profit, is much better than the alternatives.

13rac1 7y ago
I strongly prefer Go's "option B" over node_modules. Your concerns (immutability, reliability, and general code existence) are handled by vendoring. Vendoring has the added benefit of enabling project builds without additional HTTP dependencies; entirely avoiding the "left-pad" problem class. I wish my NPM projects were so easy.
_jal 7y ago
There are other models. CPAN, for instance, has worked incredibly well for its audience for 25 years and counting. https://www.cpan.org https://www.cpan.org
- the_duke 7y ago
  But, unless I'm missing something, CPAN is a centralized registry, just like npm?
  - y4mi 7y ago
    > The master CPAN site is hosted by Phyber in Los Angeles, Agreed. Maybe he meant the mirrors and how you could use them interchangeably? But that would be strange too, considering it's just as easy to create your own npm mirror as well
  - _jal 7y ago
    I was more getting at the governance model. You didn't say this, but the direction of the discussion seemed to be that centralized metadata == for-profit.
TeMPOraL 7y ago
C) Content addressing, Torrent/IPFS style. JS devs keep downloading and redownloading the same stuff all over again, all the time; maybe it's time they gave some bandwidth back.