9 ms·

Lack of cdnjs activity

236 points by spirit23 7y ago

bdcravens 7y ago
How many rely on these CDNs as core (yet free) infrastructure?
- sudhirj 7y ago
  CDN JS isn't the CDN. The gives you links and shortcuts to use other CDNs, like Cloudflare, MaxCDN, Stack-something and others. Don't think any of the libraries are served from CDNJS properties itself - how would they pay the bills?
  - disiplus 7y ago
    are you sure ? https://cdnjs.cloudflare.com/ajax/libs/react/16.10.2/cjs/react.development.js https://cdnjs.cloudflare.com/ajax/libs/react/16.10.2/cjs/rea... https://cdnjs.com/libraries/react https://cdnjs.com/libraries/react
    - mmahemoff 7y ago
      Right, Cloudflare is basically hosting the contents of this repo. The owner disappearing means new versions are not being hosted.
    - sudhirj 7y ago
      Yeah the fuse is the actual hosting and the second is the index page. So you could fork the repo, reach out to Cloudflare and start on newcdnjs.com for the index and newcdnjs.cloudflare.com for hosting.
      - MattIPv4 7y ago
        Whilst that's do-able, this means you'd be starting a new CDN on a new domain from scratch. Bringing the existing CDNJS traffic over to something new would be a very difficult challenge.
        capableweb 7y ago
        Why is that? If CloudFlare is on-board, they can help adding redirects where needed.
- stblack 7y ago
  Quick Github search for ‘cdnjs’ returns 22M code hits.
- MattIPv4 7y ago
  We publish some basic usage stats each month here: https://github.com/cdnjs/cf-stats https://github.com/cdnjs/cf-stats That gives you an idea of the scale of usage of the service. 157 billion requests last month.
atemerev 7y ago
Okay, this is what the fork button is for.
- jimws 7y ago
  Forking is not as trivial as you make it sound. You need to setup CI/CD with the new fork, then persuade the community to get on board the new fork. The bigger problem is to get the infrastructure and money to host a live CDN that serves the users.
  - codemati 7y ago
    To clarify: it looks like CloudFlare is the actual CDN behind CDNJS. And getting on board the new fork would mean updates to every single reference to CDNJS URLs (in codebases), on top of the community of contributors moving. Yikes.
    - llarsson 7y ago
      Seems to me like Cloudflare would be in a position where they could effectively decide on a new official fork and make sure it is one that is more sustainably maintained, then.
      - manigandham 7y ago
        Cloudflare is already part of the jsDelivr network, if they're going to redirect then they should just redirect to that completely.
        diggan 7y ago
        Seems there is a vital difference in their operating procedures though as jsDelivr is owned and operated by the for-profit company Prospect One and on their whims, compared to cdnjs which is community driven (even if the core community is really, really small).
  - mmahemoff 7y ago
thinkloop 7y ago
The entire cdnjs is one dude plus some "core" maintainers with no access? Amazing.
- jimws 7y ago
  That's the reality of a lot of open source based services. Did you know that the entire PyPI was run and probably still is being run by just two guys?
  - xtreak29 7y ago
    And infrastructure cost is 2-3 million dollars per year to have PyPI running. https://twitter.com/dstufft/status/1127320131359653890 https://twitter.com/dstufft/status/1127320131359653890
- gempir 7y ago
  This the normal in open source sadly. Most companies don't bother paying what they use so there are few people who can maintain such projects. I mean even the Linux Kernel was maintained like that a few years ago.
- paulddraper 7y ago
  Wait until you hear about OpenSSL.
  - deleted 7y ago
    [deleted]
  - boffinism 7y ago
    Can someone tl;dr for me?
    - cameronbrown 7y ago
      Heartbleed was a direct result of lack of resources. Billions of dollars have been shifted through OpenSSL but nobody thought to contribute back to this critical infra.
piscisaureus 7y ago
Looks like the "founder" is https://github.com/ryankirkman https://github.com/ryankirkman. Doesn't look like he's MIA but rather distracted / doing something else.
- weinzierl 7y ago
  No activity since Oct 3. I wouldn't draw any strong conclusion from this in either direction.
  - Thorrez 7y ago
    Looks like he made contributions to a private repository on Oct 25.
    - weinzierl 7y ago
      You are right, I missed that. One can clearly see it in the punch card chart.
onion2k 7y ago
There's a lesson here for anyone who dreams of getting famous maintaining something in the open source world - if it grows huge and you're not willing to share control (and fame, and maybe money) you can't take really a break from it. You will always have to be there or risk losing it very quickly. Software development at scale is about much more than code. It's about maintaining relationships with people, being willing to trust other people can do good work without your input, and sharing responsibility for what you started. All the really awesome open source projects have people who are good at those things at their core.
- kilian 7y ago
  Yes. Please CDNjs, give us enterprise level support because all of us pay you the gigantic salary of... Nothing. Wait. Okay, no, You can't take a break because we give you huge donations that make it so the 5 maintainers can afford spend time working on it. You can easily feed 5 people or families on the annual donations of... $52.65 [1] Okay. In all seriousness. No one doing open source owns anyone anything. Software at scale is a job. Jobs have salaries. Microsoft depends on it? How about Microsoft spends 10% of an engineering salary supporting it? [1] https://opencollective.com/cdnjs#section-budget https://opencollective.com/cdnjs#section-budget They also have patreon, which is bringing in $0 per month.
  - jiofih 7y ago
    Well, that’s how it’s supposed to work. Microsoft (has or any other company) supports it by having their engineers contribute to it. You seem angry about lack of funding. Why do you believe anyone is entitled to impose a paid-by-the-hour model over open source? How do you think the entire technology stack you’re typing this on was built?
    - akerro 7y ago
      >Microsoft (has or any other company) supports it by having their engineers contribute to it. If project goes down and maintainers leave the project, Microsoft also loses money spent on their engineers contributing there. They will have to fork the project, put more people on it, waste a lot of time by re-learning code and start contributing. Money and time would be better spent by just donating to current main maintainers.
manigandham 7y ago
This is why I recommend jsDelivr instead: https://www.jsdelivr.com/ https://www.jsdelivr.com/ It's a free CDN that automatically pulls from NPM or Github based on repo URL without any submission/approval bottlenecks. It's also more robust with multiple CDN and DNS providers.
- greggman2 7y ago
  https://unpkg.com/ https://unpkg.com/ as well cdnjs doesn't work well with es6 modules or at least requires more manual labor. unpkg and jsdelivr work because they keep the structure defined in the package.json
  - root_axis 7y ago
    I would definitely avoid unpkg.com https://twitter.com/centrisimo/status/1190213354213838855 https://twitter.com/centrisimo/status/1190213354213838855 https://twitter.com/vdanielpop/status/1190234073987518465 https://twitter.com/vdanielpop/status/1190234073987518465 https://twitter.com/BaggaleyGeorge/status/1190260049391890434 https://twitter.com/BaggaleyGeorge/status/119026004939189043... https://github.com/mjackson/unpkg/issues/176 https://github.com/mjackson/unpkg/issues/176
oefrha 7y ago
410 GONE is a potential problem in any important open source project with a low bus factor.
- z3t4 7y ago
  The problem is that if you spread the privileges between many people, especially in a voluntarily project, it usually ends up with no-one doing any work. I have experienced it over and over again. Meanwhile if there is only one person in charge he/she will often end up doing a tremendous amount of work. It's like, if the the whole organization depends on you, you feel more responsibility.
bouke 7y ago
I guess the lesson to learn here is that you shouldn't rely on externally hosted assets. Just host it yourself, its not that hard. If you're concerned about the bandwidth cost, you should probably charge more for the service your providing.
- lixtra 7y ago
  There is a downside though: a copy has to be downloaded for each website, so each first website load is slowed down. What’s missing is a way to tell the browser to use a certain resource (identified by its hash) and a url to download it. That way the browser could cache the object across websites and download from a source that the requesting website controls. It could look like this hash://sha256/71dc8dd15ea156387fa9efaf380e7f8d39187a549649bec62a39aee3cf4fdc55//https://raw.githubusercontent.com/cdnjs/cdnjs/2c95eae0dc3569f0cb15c8a5f9173220b49156bc/README.md I also vaguely remember that magnet links were similar.
  - scrollaway 7y ago
    Immutable cache and subresource integrity get us most of the way there. I don't know if web browsers share those across domains, but I don't think there's a reason not to.
    - captncraig 7y ago
      Possibly privacy. If I host a copy of a popular site's Js, I can watch download patterns and have a pretty reliable "has this user logged into site X" detector.
      - johannes1234321 7y ago
        What you could do is the negative "they won't load this file" which could have many reasons (from connection breaking just after the HTML to JS blockers) And I believe it's a good solution to restrict such a feature to files already marked with a hash on the origin. They would only do that for common libraries found elsewhere as well.
jiofih 7y ago
> No direct financial sponsorship (or any funding) for core maintainers to work on cdnjs Unpopular opinion ahead: I find that demanding money after “voluntarily” contributing to an open-source almost offensive to the spirit of OSS. Money changes the incentives around a community project in an irreversible way. Note that the issue here has nothing to do with financial support. EDIT: This is regarding the “core maintainers” comment in the linked thread, and not a judgement of anyone’s ability. I gave away years of my own time to open source projects earlier in my career. It was very rewarding in many ways, even financially - what I learned made me a lot better at my job. Am I not allowed to be ok with that, and believe that a paid contribution model is not ideal for OSS?
- cristianbica 7y ago
  So if someone asks "why don't you do more voluntary work" and the answer is "besides some organizational issues there no financial support" you find that offensive?
  - jiofih 7y ago
    That was not the question, and the problem at hand has nothing to do with lack of funding. That actually makes the pledge even worse. When there are not enough interested persons to keep a project alive, let it die. As shown in other comments, the same infra can be achieved in an automated fashion without the need for lots of human intervention.
- z3t4 7y ago
  How did you get financially rewarded by participating in OSS? eg. did it help you find a job? Did you get donations. Or how did you do it? I think the best route is 1) Get a paid job 2) Do OOS on the job. Meanwhile a lot of people do the mistake of 1) Do OSS for free 2) Ask for financial support
  - heisenbit 7y ago
    People donating time often donate other resources too, some of them cost hard cash.
fareesh 7y ago
Hypothetical question - what if a "founder" of a widely adopted service like cdnjs becomes incapacitated or dead, is everyone supposed to just follow a fork or is there some kind of provision to hand over control to someone? How can the successor be chosen in such cases?
- joatmon-snoo 7y ago
  Well, you can plan for that. N+2 and all that isn't just for servers, works for humans too :) If you haven't planned for it? Hopefully there are maintainers/contributors who care enough and have the resources to step up, figure out a plan, and execute it. If not? Have fun maintaining your own fork and finding out about security bugs on the front page of HN.
- gbuk2013 7y ago
  AKA “bus factor”: https://en.m.wikipedia.org/wiki/Bus_factor https://en.m.wikipedia.org/wiki/Bus_factor
  - fareesh 7y ago
    Thanks I wasn't familiar with the term, TIL
- diggan 7y ago
  Just this happened in the Clojure community when Raynes (Anthony Grimes) died. He made a lot of utils and projects for the community available open source and since his passing in 2016, community forks have been available in other organizations or willing users who fork and continue maintenance. See for example https://github.com/Raynes/tentacles https://github.com/Raynes/tentacles which now "moved" to clj-commons https://github.com/clj-commons/tentacles https://github.com/clj-commons/tentacles Edit: just learned after looking up more about it that Raynes also seems to have been behind the creation of Elixir's Mix toolkit (Mix is Bundler, RubyGems, and Rake combined) so he touched on a lot of peoples life outside of Clojure as well.
  - fareesh 7y ago
petecooper 7y ago
I am a former maintainer / librarian on cdnJS. I helped out some years ago when I wanted to learn how version control and git worked. This was in the pre-automation era (2013 to 2014 in my case), and I went through the existing libraries to find outdated instances, located new versions of the same, raised the PR to update it. All good. Back then, and I don't know how much has changed, the libraries were maintained on GitHub and CloudFlare did the hosting. I wasn't aware of any problems with either organisation doing what they were doing, the system worked just fine. The founders (see https://cdnjs.com/about https://cdnjs.com/about for confirmation) Thomas and Ryan were around, but not super active. Thomas was involved in building out some of the automation infrastructure, but the day-to-day of updating the repo was largely undertaken by the maintainers, and that was fine. I never 'met' either founder, but we had occasional email back and forth and they were grateful for my maintainer-ing. I used the GitHub Mac app because I was finding my way. Whenever I changed any library, the action of the app checking a HUGE repo for any changes pegged my laptop for a few minutes every time. Not ideal, but the process of doing this librarian-ing helped me learn about a heap of stuff. According to [1] I stopped on cdnJS mid-2014. Things got a bit twitchy for me when a library (edit: jPlayer) was pulled from the file structure because it was compromised (edit: XSS) or found malicious at release. I had a couple of user complaints directed at me because I was the one that added it in good faith originally (it passed the malware checks I ran on it). The founders stepped up to explain it wasn't me that was to blame, and one person didn't take that too well -- basically they found me on other software forums, posted threats to me and explained how the library that I had added, and someone else had removed, was crucial to their business and they'd lost such-and-such dollars in revenue with that library 404-ing without notice and that they were coming to find me and extract the money from me by force. It all died down a few weeks later. [1] https://github.com/petecooper?tab=overview&from=2014-12-01&to=2014-12-31 https://github.com/petecooper?tab=overview&from=2014-12-01&t... Edits: clarity.
- jlokier 7y ago
  > they found me on other software forums, posted threats to me and explained how the library that I had added, and someone else had removed, was crucial to their business and they'd lost such-and-such dollars in revenue with that library 404-ing without notice and that they were coming to find me and extract the money from me by force Wow, that really takes "open source maintainer abuse" to a whole other level.
thomasfromcdnjs 7y ago
Hey everyone, My name is Thomas, one of the original founders of cdnjs along with Ryan (linked below by another commenter). We originally posted cdnjs on Hacker News in 2011 -> https://news.ycombinator.com/item?id=2828516 https://news.ycombinator.com/item?id=2828516 The project was originally created on AWS Cloudfront, Ryan and I thought we could handle the bills. In retrospect that was incredibly naive so we were fortunate to partner with Cloudflare. At the time, cdnjs was a baby, Cloudflare had just started entering the market. In short, Cloudflare always owned the domain, cdnjs.cloudflare.com, meaning, we were constrained to work under the DNS level. We have both put considerable amounts of work into the project, but nothing compared to the community and the "core" contributors. I put "core" into quotes because for the last 5 years, cdnjs has largely been run by a highly dedicated man named Peter. https://github.com/PeterDaveHello https://github.com/PeterDaveHello Peter built enormous amounts of infrastructure to support cdnjs. He is extremely diligent, intelligent and determined. The project was Ryan's and I "baby" but we were happy to relinquish control, sorry for all the "buts", but we were not in a position to control due to the technical and commercial reasons. Ryan and I have never personally profited off the project, we've only paid bills and late night ssh sessions. Conversations are underway to move forward, it is likely that the project will move to an unpkg setup (assets are just mirrored to npm). A lot to say, but I'm at a lack of words. Happy to answer any and all questions.
- suresh70 7y ago
  Do you guys have any plans for short term relief to clear out the pending PRs and keep the show running?.
  - MattIPv4 7y ago
    Nothing that I've heard so far - though I'm happy to be corrected by Thomas or Ryan.
- MattIPv4 7y ago
  It'd be lovely to hear this internally. Peter & I have been trying for the last many months to gain more access and control so we can keep it going. Alas, that didn't happen, so Peter stepped down and is no longer maintaining cdnjs. I'm still here to try and keep it alive, but hearing nothing internally makes that rather hard :(
brightball 7y ago
It’s one think to make and release open source software. It’s entirely another to maintain a free service.
ZoomZoomZoom 7y ago
Well, I've read the whole linked Issue and only then understood that it's not in fact CJDNS[1]. The latest commit there is Aug, 6, which is very frustrating. I'd love to see HN crowd paying more attention to such projects. [1] https://github.com/cjdelisle/cjdns/ https://github.com/cjdelisle/cjdns/
- chrisweekly 7y ago
  CDNJS - a CDN (content delivery network) for JS (javascript) CJDNS - DNS software for ip6, by "CJ" IOW, totally unrelated.
- tdjsnelling 7y ago
  Yggdrasil[1] is a similar project that seems to be a bit more active, if you're interested. [1] https://github.com/yggdrasil-network/yggdrasil-go https://github.com/yggdrasil-network/yggdrasil-go
- codetrotter 7y ago
  Is there a specific bug or missing feature that has you frustrated in that project? And also, note that yeah they last pushed to master in August, but they've been doing work since then on at least one other branch. https://github.com/cjdelisle/cjdns/tree/crashey https://github.com/cjdelisle/cjdns/tree/crashey Software should mature and when it does, development should slow down. I don't use cjdns myself, but from what I've heard it seems to be a solid piece of software. If you had personally submitted a PR to the project and it was sitting there unacknowledged, or you were seeing lots of PRs by others sitting unresponded to then I could see a reason for being frustrated. But there are only two open PRs at the moment, and only one of them is without any comments.
rpmisms 7y ago
At the risk of seeming trollish... What are we doing? Deploy the donations!
fks 7y ago
Really sad to see this, I remember relying on cdnjs at a few old jobs over the years. Hope they get this sorted. If anyone is looking for alternatives, I created Pika CDN as a modern alternative for cdnjs/jsdelivr/unpkg. It runs off of npm (so no approval bottlenecks) and is 100% modern ESM (so you can `import` every package directly in the browser without a bundler). https://www.pika.dev/cdn https://www.pika.dev/cdn
zackbloom 7y ago
Hello from Cloudflare! We're involved with CDNJS as we host the CDN-part of the project. We will support CDNJS and the sites which rely on it, period. If your site uses CDNJS you can trust it will continue to be fast and functional. We have engineers currently working with the CDNJS team to get updates happening again. Once that is done we will start to think about the best way to keep CDNJS updating without requiring as much human intervention in the future. Thanks for your patience and feel free to ask any questions here.
- MattIPv4 7y ago
  Thank you for everything <3

236 points by spirit23 7y ago

bdcravens 7y ago

How many rely on these CDNs as core (yet free) infrastructure?

sudhirj 7y ago
CDN JS isn't the CDN. The gives you links and shortcuts to use other CDNs, like Cloudflare, MaxCDN, Stack-something and others. Don't think any of the libraries are served from CDNJS properties itself - how would they pay the bills?
- disiplus 7y ago
  are you sure ? https://cdnjs.cloudflare.com/ajax/libs/react/16.10.2/cjs/react.development.js https://cdnjs.cloudflare.com/ajax/libs/react/16.10.2/cjs/rea... https://cdnjs.com/libraries/react https://cdnjs.com/libraries/react
  - mmahemoff 7y ago
    Right, Cloudflare is basically hosting the contents of this repo. The owner disappearing means new versions are not being hosted.
  - sudhirj 7y ago
    Yeah the fuse is the actual hosting and the second is the index page. So you could fork the repo, reach out to Cloudflare and start on newcdnjs.com for the index and newcdnjs.cloudflare.com for hosting.
    - MattIPv4 7y ago
      Whilst that's do-able, this means you'd be starting a new CDN on a new domain from scratch. Bringing the existing CDNJS traffic over to something new would be a very difficult challenge.
      - capableweb 7y ago
        Why is that? If CloudFlare is on-board, they can help adding redirects where needed.
stblack 7y ago
Quick Github search for ‘cdnjs’ returns 22M code hits.
MattIPv4 7y ago
We publish some basic usage stats each month here: https://github.com/cdnjs/cf-stats https://github.com/cdnjs/cf-stats That gives you an idea of the scale of usage of the service. 157 billion requests last month.

atemerev 7y ago

Okay, this is what the fork button is for.

jimws 7y ago
Forking is not as trivial as you make it sound. You need to setup CI/CD with the new fork, then persuade the community to get on board the new fork. The bigger problem is to get the infrastructure and money to host a live CDN that serves the users.
- codemati 7y ago
  To clarify: it looks like CloudFlare is the actual CDN behind CDNJS. And getting on board the new fork would mean updates to every single reference to CDNJS URLs (in codebases), on top of the community of contributors moving. Yikes.
  - llarsson 7y ago
    Seems to me like Cloudflare would be in a position where they could effectively decide on a new official fork and make sure it is one that is more sustainably maintained, then.
    - manigandham 7y ago
      Cloudflare is already part of the jsDelivr network, if they're going to redirect then they should just redirect to that completely.
      - diggan 7y ago
        Seems there is a vital difference in their operating procedures though as jsDelivr is owned and operated by the for-profit company Prospect One and on their whims, compared to cdnjs which is community driven (even if the core community is really, really small).
- mmahemoff 7y ago

thinkloop 7y ago

The entire cdnjs is one dude plus some "core" maintainers with no access? Amazing.

jimws 7y ago
That's the reality of a lot of open source based services. Did you know that the entire PyPI was run and probably still is being run by just two guys?
- xtreak29 7y ago
  And infrastructure cost is 2-3 million dollars per year to have PyPI running. https://twitter.com/dstufft/status/1127320131359653890 https://twitter.com/dstufft/status/1127320131359653890
gempir 7y ago
This the normal in open source sadly. Most companies don't bother paying what they use so there are few people who can maintain such projects. I mean even the Linux Kernel was maintained like that a few years ago.
paulddraper 7y ago
Wait until you hear about OpenSSL.
- deleted 7y ago
  [deleted]
- boffinism 7y ago
  Can someone tl;dr for me?
  - cameronbrown 7y ago
    Heartbleed was a direct result of lack of resources. Billions of dollars have been shifted through OpenSSL but nobody thought to contribute back to this critical infra.

piscisaureus 7y ago

Looks like the "founder" is https://github.com/ryankirkman https://github.com/ryankirkman. Doesn't look like he's MIA but rather distracted / doing something else.

weinzierl 7y ago
No activity since Oct 3. I wouldn't draw any strong conclusion from this in either direction.
- Thorrez 7y ago
  Looks like he made contributions to a private repository on Oct 25.
  - weinzierl 7y ago
    You are right, I missed that. One can clearly see it in the punch card chart.

onion2k 7y ago

There's a lesson here for anyone who dreams of getting famous maintaining something in the open source world - if it grows huge and you're not willing to share control (and fame, and maybe money) you can't take really a break from it. You will always have to be there or risk losing it very quickly. Software development at scale is about much more than code. It's about maintaining relationships with people, being willing to trust other people can do good work without your input, and sharing responsibility for what you started. All the really awesome open source projects have people who are good at those things at their core.

kilian 7y ago
Yes. Please CDNjs, give us enterprise level support because all of us pay you the gigantic salary of... Nothing. Wait. Okay, no, You can't take a break because we give you huge donations that make it so the 5 maintainers can afford spend time working on it. You can easily feed 5 people or families on the annual donations of... $52.65 [1] Okay. In all seriousness. No one doing open source owns anyone anything. Software at scale is a job. Jobs have salaries. Microsoft depends on it? How about Microsoft spends 10% of an engineering salary supporting it? [1] https://opencollective.com/cdnjs#section-budget https://opencollective.com/cdnjs#section-budget They also have patreon, which is bringing in $0 per month.
- jiofih 7y ago
  Well, that’s how it’s supposed to work. Microsoft (has or any other company) supports it by having their engineers contribute to it. You seem angry about lack of funding. Why do you believe anyone is entitled to impose a paid-by-the-hour model over open source? How do you think the entire technology stack you’re typing this on was built?
  - akerro 7y ago
    >Microsoft (has or any other company) supports it by having their engineers contribute to it. If project goes down and maintainers leave the project, Microsoft also loses money spent on their engineers contributing there. They will have to fork the project, put more people on it, waste a lot of time by re-learning code and start contributing. Money and time would be better spent by just donating to current main maintainers.

manigandham 7y ago

This is why I recommend jsDelivr instead: https://www.jsdelivr.com/ https://www.jsdelivr.com/ It's a free CDN that automatically pulls from NPM or Github based on repo URL without any submission/approval bottlenecks. It's also more robust with multiple CDN and DNS providers.

greggman2 7y ago
https://unpkg.com/ https://unpkg.com/ as well cdnjs doesn't work well with es6 modules or at least requires more manual labor. unpkg and jsdelivr work because they keep the structure defined in the package.json
- root_axis 7y ago
  I would definitely avoid unpkg.com https://twitter.com/centrisimo/status/1190213354213838855 https://twitter.com/centrisimo/status/1190213354213838855 https://twitter.com/vdanielpop/status/1190234073987518465 https://twitter.com/vdanielpop/status/1190234073987518465 https://twitter.com/BaggaleyGeorge/status/1190260049391890434 https://twitter.com/BaggaleyGeorge/status/119026004939189043... https://github.com/mjackson/unpkg/issues/176 https://github.com/mjackson/unpkg/issues/176

oefrha 7y ago

410 GONE is a potential problem in any important open source project with a low bus factor.

z3t4 7y ago
The problem is that if you spread the privileges between many people, especially in a voluntarily project, it usually ends up with no-one doing any work. I have experienced it over and over again. Meanwhile if there is only one person in charge he/she will often end up doing a tremendous amount of work. It's like, if the the whole organization depends on you, you feel more responsibility.

bouke 7y ago

I guess the lesson to learn here is that you shouldn't rely on externally hosted assets. Just host it yourself, its not that hard. If you're concerned about the bandwidth cost, you should probably charge more for the service your providing.

lixtra 7y ago
There is a downside though: a copy has to be downloaded for each website, so each first website load is slowed down. What’s missing is a way to tell the browser to use a certain resource (identified by its hash) and a url to download it. That way the browser could cache the object across websites and download from a source that the requesting website controls. It could look like this hash://sha256/71dc8dd15ea156387fa9efaf380e7f8d39187a549649bec62a39aee3cf4fdc55//https://raw.githubusercontent.com/cdnjs/cdnjs/2c95eae0dc3569f0cb15c8a5f9173220b49156bc/README.md I also vaguely remember that magnet links were similar.
- scrollaway 7y ago
  Immutable cache and subresource integrity get us most of the way there. I don't know if web browsers share those across domains, but I don't think there's a reason not to.
  - captncraig 7y ago
    Possibly privacy. If I host a copy of a popular site's Js, I can watch download patterns and have a pretty reliable "has this user logged into site X" detector.
    - johannes1234321 7y ago
      What you could do is the negative "they won't load this file" which could have many reasons (from connection breaking just after the HTML to JS blockers) And I believe it's a good solution to restrict such a feature to files already marked with a hash on the origin. They would only do that for common libraries found elsewhere as well.

jiofih 7y ago

> No direct financial sponsorship (or any funding) for core maintainers to work on cdnjs Unpopular opinion ahead: I find that demanding money after “voluntarily” contributing to an open-source almost offensive to the spirit of OSS. Money changes the incentives around a community project in an irreversible way. Note that the issue here has nothing to do with financial support. EDIT: This is regarding the “core maintainers” comment in the linked thread, and not a judgement of anyone’s ability. I gave away years of my own time to open source projects earlier in my career. It was very rewarding in many ways, even financially - what I learned made me a lot better at my job. Am I not allowed to be ok with that, and believe that a paid contribution model is not ideal for OSS?

cristianbica 7y ago
So if someone asks "why don't you do more voluntary work" and the answer is "besides some organizational issues there no financial support" you find that offensive?
- jiofih 7y ago
  That was not the question, and the problem at hand has nothing to do with lack of funding. That actually makes the pledge even worse. When there are not enough interested persons to keep a project alive, let it die. As shown in other comments, the same infra can be achieved in an automated fashion without the need for lots of human intervention.
z3t4 7y ago
How did you get financially rewarded by participating in OSS? eg. did it help you find a job? Did you get donations. Or how did you do it? I think the best route is 1) Get a paid job 2) Do OOS on the job. Meanwhile a lot of people do the mistake of 1) Do OSS for free 2) Ask for financial support
- heisenbit 7y ago
  People donating time often donate other resources too, some of them cost hard cash.

fareesh 7y ago

Hypothetical question - what if a "founder" of a widely adopted service like cdnjs becomes incapacitated or dead, is everyone supposed to just follow a fork or is there some kind of provision to hand over control to someone? How can the successor be chosen in such cases?

joatmon-snoo 7y ago
Well, you can plan for that. N+2 and all that isn't just for servers, works for humans too :) If you haven't planned for it? Hopefully there are maintainers/contributors who care enough and have the resources to step up, figure out a plan, and execute it. If not? Have fun maintaining your own fork and finding out about security bugs on the front page of HN.
gbuk2013 7y ago
AKA “bus factor”: https://en.m.wikipedia.org/wiki/Bus_factor https://en.m.wikipedia.org/wiki/Bus_factor
- fareesh 7y ago
  Thanks I wasn't familiar with the term, TIL
diggan 7y ago
Just this happened in the Clojure community when Raynes (Anthony Grimes) died. He made a lot of utils and projects for the community available open source and since his passing in 2016, community forks have been available in other organizations or willing users who fork and continue maintenance. See for example https://github.com/Raynes/tentacles https://github.com/Raynes/tentacles which now "moved" to clj-commons https://github.com/clj-commons/tentacles https://github.com/clj-commons/tentacles Edit: just learned after looking up more about it that Raynes also seems to have been behind the creation of Elixir's Mix toolkit (Mix is Bundler, RubyGems, and Rake combined) so he touched on a lot of peoples life outside of Clojure as well.
- fareesh 7y ago

petecooper 7y ago

I am a former maintainer / librarian on cdnJS. I helped out some years ago when I wanted to learn how version control and git worked. This was in the pre-automation era (2013 to 2014 in my case), and I went through the existing libraries to find outdated instances, located new versions of the same, raised the PR to update it. All good. Back then, and I don't know how much has changed, the libraries were maintained on GitHub and CloudFlare did the hosting. I wasn't aware of any problems with either organisation doing what they were doing, the system worked just fine. The founders (see https://cdnjs.com/about https://cdnjs.com/about for confirmation) Thomas and Ryan were around, but not super active. Thomas was involved in building out some of the automation infrastructure, but the day-to-day of updating the repo was largely undertaken by the maintainers, and that was fine. I never 'met' either founder, but we had occasional email back and forth and they were grateful for my maintainer-ing. I used the GitHub Mac app because I was finding my way. Whenever I changed any library, the action of the app checking a HUGE repo for any changes pegged my laptop for a few minutes every time. Not ideal, but the process of doing this librarian-ing helped me learn about a heap of stuff. According to [1] I stopped on cdnJS mid-2014. Things got a bit twitchy for me when a library (edit: jPlayer) was pulled from the file structure because it was compromised (edit: XSS) or found malicious at release. I had a couple of user complaints directed at me because I was the one that added it in good faith originally (it passed the malware checks I ran on it). The founders stepped up to explain it wasn't me that was to blame, and one person didn't take that too well -- basically they found me on other software forums, posted threats to me and explained how the library that I had added, and someone else had removed, was crucial to their business and they'd lost such-and-such dollars in revenue with that library 404-ing without notice and that they were coming to find me and extract the money from me by force. It all died down a few weeks later. [1] https://github.com/petecooper?tab=overview&from=2014-12-01&to=2014-12-31 https://github.com/petecooper?tab=overview&from=2014-12-01&t... Edits: clarity.

jlokier 7y ago
> they found me on other software forums, posted threats to me and explained how the library that I had added, and someone else had removed, was crucial to their business and they'd lost such-and-such dollars in revenue with that library 404-ing without notice and that they were coming to find me and extract the money from me by force Wow, that really takes "open source maintainer abuse" to a whole other level.

thomasfromcdnjs 7y ago

Hey everyone, My name is Thomas, one of the original founders of cdnjs along with Ryan (linked below by another commenter). We originally posted cdnjs on Hacker News in 2011 -> https://news.ycombinator.com/item?id=2828516 https://news.ycombinator.com/item?id=2828516 The project was originally created on AWS Cloudfront, Ryan and I thought we could handle the bills. In retrospect that was incredibly naive so we were fortunate to partner with Cloudflare. At the time, cdnjs was a baby, Cloudflare had just started entering the market. In short, Cloudflare always owned the domain, cdnjs.cloudflare.com, meaning, we were constrained to work under the DNS level. We have both put considerable amounts of work into the project, but nothing compared to the community and the "core" contributors. I put "core" into quotes because for the last 5 years, cdnjs has largely been run by a highly dedicated man named Peter. https://github.com/PeterDaveHello https://github.com/PeterDaveHello Peter built enormous amounts of infrastructure to support cdnjs. He is extremely diligent, intelligent and determined. The project was Ryan's and I "baby" but we were happy to relinquish control, sorry for all the "buts", but we were not in a position to control due to the technical and commercial reasons. Ryan and I have never personally profited off the project, we've only paid bills and late night ssh sessions. Conversations are underway to move forward, it is likely that the project will move to an unpkg setup (assets are just mirrored to npm). A lot to say, but I'm at a lack of words. Happy to answer any and all questions.

suresh70 7y ago
Do you guys have any plans for short term relief to clear out the pending PRs and keep the show running?.
- MattIPv4 7y ago
  Nothing that I've heard so far - though I'm happy to be corrected by Thomas or Ryan.
MattIPv4 7y ago
It'd be lovely to hear this internally. Peter & I have been trying for the last many months to gain more access and control so we can keep it going. Alas, that didn't happen, so Peter stepped down and is no longer maintaining cdnjs. I'm still here to try and keep it alive, but hearing nothing internally makes that rather hard :(

brightball 7y ago

It’s one think to make and release open source software. It’s entirely another to maintain a free service.

ZoomZoomZoom 7y ago

Well, I've read the whole linked Issue and only then understood that it's not in fact CJDNS[1]. The latest commit there is Aug, 6, which is very frustrating. I'd love to see HN crowd paying more attention to such projects. [1] https://github.com/cjdelisle/cjdns/ https://github.com/cjdelisle/cjdns/

chrisweekly 7y ago
CDNJS - a CDN (content delivery network) for JS (javascript) CJDNS - DNS software for ip6, by "CJ" IOW, totally unrelated.
tdjsnelling 7y ago
Yggdrasil[1] is a similar project that seems to be a bit more active, if you're interested. [1] https://github.com/yggdrasil-network/yggdrasil-go https://github.com/yggdrasil-network/yggdrasil-go
codetrotter 7y ago
Is there a specific bug or missing feature that has you frustrated in that project? And also, note that yeah they last pushed to master in August, but they've been doing work since then on at least one other branch. https://github.com/cjdelisle/cjdns/tree/crashey https://github.com/cjdelisle/cjdns/tree/crashey Software should mature and when it does, development should slow down. I don't use cjdns myself, but from what I've heard it seems to be a solid piece of software. If you had personally submitted a PR to the project and it was sitting there unacknowledged, or you were seeing lots of PRs by others sitting unresponded to then I could see a reason for being frustrated. But there are only two open PRs at the moment, and only one of them is without any comments.

rpmisms 7y ago

At the risk of seeming trollish... What are we doing? Deploy the donations!

fks 7y ago

Really sad to see this, I remember relying on cdnjs at a few old jobs over the years. Hope they get this sorted. If anyone is looking for alternatives, I created Pika CDN as a modern alternative for cdnjs/jsdelivr/unpkg. It runs off of npm (so no approval bottlenecks) and is 100% modern ESM (so you can `import` every package directly in the browser without a bundler). https://www.pika.dev/cdn https://www.pika.dev/cdn

zackbloom 7y ago

Hello from Cloudflare! We're involved with CDNJS as we host the CDN-part of the project. We will support CDNJS and the sites which rely on it, period. If your site uses CDNJS you can trust it will continue to be fast and functional. We have engineers currently working with the CDNJS team to get updates happening again. Once that is done we will start to think about the best way to keep CDNJS updating without requiring as much human intervention in the future. Thanks for your patience and feel free to ask any questions here.

MattIPv4 7y ago
Thank you for everything <3