4 ms·
The only alternatives to a single source of truth repository are A) multiple large, competing repositories B) a distributed system like Go which relies on jus
by the_duke 8y ago
The only alternatives to a single source of truth repository are
A) multiple large, competing repositories
B) a distributed system like Go which relies on just a path to the source repository
Both of those suck. A) is messy and confusing, B) has a whole host of problems (no immutability, no reliability and assurance that the code will be here tomorrow, mandatory vendoring, ....).
Sure, a community driven non profit foundation in charge would be ideal, but a single source of truth, even if for profit, is much better than the alternatives.
- 13rac1 8y agoI strongly prefer Go's "option B" over node_modules. Your concerns (immutability, reliability, and general code existence) are handled by vendoring. Vendoring has the added benefit of enabling project builds without additional HTTP dependencies; entirely avoiding the "left-pad" problem class. I wish my NPM projects were so easy.
- _jal 8y agoThere are other models. CPAN, for instance, has worked incredibly well for its audience for 25 years and counting. https://www.cpan.org https://www.cpan.org
- the_duke 8y agoBut, unless I'm missing something, CPAN is a centralized registry, just like npm?
- y4mi 8y ago> The master CPAN site is hosted by Phyber in Los Angeles, Agreed. Maybe he meant the mirrors and how you could use them interchangeably? But that would be strange too, considering it's just as easy to create your own npm mirror as well
- _jal 8y agoI was more getting at the governance model. You didn't say this, but the direction of the discussion seemed to be that centralized metadata == for-profit.
- TeMPOraL 8y agoC) Content addressing, Torrent/IPFS style. JS devs keep downloading and redownloading the same stuff all over again, all the time; maybe it's time they gave some bandwidth back.