34 ms·

NPM Is Joining GitHub

1829 points by mholt 7y ago

petey283 7y ago
I worry that this is too much consolidation.
- Analemma_ 7y ago
  I hope you're spending lots of money at independent places then, because this is the inevitable result of the current "OSS infrastructure funded by VC charity" model. NPM was losing money, as was GitHub when Microsoft bought that. Under such conditions, getting bought out by a megacorp is the only path forward.
sandov 7y ago
"Github acquires npm" would be a better title IMO.
- kdaigle 7y ago
  Today we've announced that we've signed an agreement to acquire NPM but we technically have not acquired them yet (referred to as "closed"). NPM is still their own company for now and that's why the language is future tense.
  - sandov 7y ago
    "Github is acquiring npm" then. "NPM is joining Github" sounds like you're just using Github to host your stuff.
    - Conan_Kudo 7y ago
      Using the "is joining" phrasing is a classic way to try to spin an acquisition as some kind of partnership. 99% of the time, it's definitely not.
    - rdiddly 7y ago
      I literally thought that, clicked hide, then thought "Wait a minute, do they mean...?" and had to go fish it out of hidden items. "Joining" is an interesting term here... but I suppose it won because it sounds more like something friendly humans would do. "NPM Is Breaking Bread and Sharing with Github as Special Friends."
  - TheKarateKid 7y ago
    Then saying "GitHub is acquiring NPM" would've been a more accurate way to say this.
- hinkley 7y ago
  I am glad that the npm team will finally have some adult supervision. Meanwhile, I almost have my team switched to yarn.
  - Normal_gaussian 7y ago
    yarn v1+ or yarn v2/berry? Switching to berry has been a huge PITA over here, but I don't want to give up workspaces
    - hinkley 7y ago
      Our 'workspace' is so ornate that yarn couldn't handle it. 1.21+ almost looks right, but something very bad is still going on with mocha deduping, such that tests are failing with really bizarre error messages. I check yarn about every three months, or when I find a new, infuriating bug with the npm CLI (so, every couple of months on average). I think npm install suffers greatly from not having a formal spec. It has been bugfixed by so many different individuals now that it has reached a truly astounding level of schizophrenia. If yarn didn't exist, I would have started trying to break down the install problem into many independent concerns that can be reasoned about individually and tried to solicit help in making a full installer out of it. If I'd known I'd still be trying to make yarn workspaces work for us 18 months later I probably would have. Node modules in general have some bad patterns of delegation that are utterly antagonistic to self-documentation, and both yarn and npm seem to suffer from this as well. I think in the next week or so I'm going to have to set up a small test case that exhibits the yarn bug I'm seeing, or any of the half a dozen interlocking (emphasis on 'lock') npm bugs that now have me painted into a very tiny corner.
      - IsaacSchlueter 7y ago
        Your take on the installer in npm v6 is not wrong. It got that way by a process of gradual iterative evolution, and it has lots of warts. npm v7 features a ground-up rewrite of the tree resolution and deification logic in the @npmcli/arborist module. I recommend checking it out, or at least staying tuned for the beta coming soon.
    - 7y ago
- ProAm 7y ago
  "Microsoft acquires npm"
- Verdex 7y ago
  Yeah, I was confused when I first heard of it because it seems like an odd couple to "join" one another. However, it makes perfect sense for github to purchase npm.
jrimbault 7y ago
Interesting transitive ownership/dependencies here.
simlevesque 7y ago
I did not see that coming. I trust Microsoft to be able to offer great availability and nice software. It is maybe not the best overlord we could have hoped for but it's way better than the status quo.
dubcanada 7y ago
Wait, so is it joining Microsoft? Or is it under Github, which is under Microsoft? I don't fully understand the way it's governed from this article.
- clarkbw 7y ago
  Part of GitHub (I work at GitHub and lead the Packages team)
  - cmckn 7y ago
    How does this acquisition relate to Package's support of npm artifacts? Or, I guess, how will Package's npm support change after this?
    - clarkbw 7y ago
      The post covers this. > Later this year, we will enable npm’s paying customers to move their private npm packages to GitHub Packages—allowing npm to exclusively focus on being a great public registry for JavaScript. Packages will continue to develop its npm registry. We have a lot of work to do in securing the software supply chain.
  - mceachen 7y ago
    Can I be so bold as to suggest a new feature? It'd be wonderful, as a package consumer, to have visibility into some security metrics for a given package. This would be useful both at initial install time, and when the package is upgraded. Something like: 1) who are the latest commits GPG signed by? 2) is the package publisher using 2FA? 3) what is the security profile of all dependent packages? 4) are there any new authors (directly or via dependencies) since the last version (with links to the author and their contributions). These might help avoid prior situations where popular packages get injected with malware by new maintainers.
    - clarkbw 7y ago
      Yes, we (internally) call this a "Bill of Health" and believe that all packages should have this kind of diff-able information available. Understanding what's happening at the source level is key to being able to trust any package published.
Brendinooo 7y ago
I occasionally forget that Microsoft bought GitHub. They certainly don't do anything here to remind me of that fact. How separate from MS has GitHub been in day-to-day operations?
- owenwil 7y ago
  GitHub employees have access to Microsoft internal tools and a Microsoft email address, so I don't think there's too much internal firewalling.
- reilly3000 7y ago
  I can't speak to company internals, but I do know that Azure is powering GitHub Actions runners, and there have been a firehose of new features coming out of GitHub in the past year. I imagine its pretty core to their "Developers Developers Developers" strategy.
- deleted 7y ago
  [deleted]
- kdaigle 7y ago
  I've been at GitHub for 7 years and we operate independently but have the support and resources of Microsoft when we need them. IMO, they've been amazing partners but day to day the GitHub team builds, prioritizes, and supports GitHub.
  - nojvek 7y ago
    It's totally the smart thing to do. Github needs a ton of cloud compute with github actions, Azure powers it. Github brings a very strong brand that developers love, which gives Microsoft a good rep amongst technical folks. This is as good as Google acquiring Youtube because Youtube needs an insane amount bandwidth and it was a perfect fit for Google's infrastructure and ad platform. It's just sad to see Google not playing the Developers game well.
  - bengale 7y ago
    Do you think they're going to try and push us towards azure more, or force us into using Microsoft logins?
batmansmk 7y ago
VsCode, Typescript, Github, NPM. And Microsoft doesn't even have to maintain the main runtime, Google does. What a clever strategy!
- lucideer 7y ago
  In fairness to Microsoft, they did at least spend a little bit of time considering / working toward maintaining the runtime part, before deciding otherwise https://github.com/nodejs/node-chakracore/issues/628#issuecomment-586139750 https://github.com/nodejs/node-chakracore/issues/628#issueco...
- swyx 7y ago
  to be clear, Chrome's overall value to Google probably dwarfs all those things combined.
- sitkack 7y ago
  They could fork it, the core of the runtimework is moving to WebAssembly anyway which is a much more tractable problem. Sure this is a boatload of JS work to do at the interface boundary but the amount of hard compiler and jit work that needs to be focused on by main runtime is much lower. Someone at MS knows strategic and tactics. When MS and Windows bootstrap themselves into the cloud, they will have some software to land on.
- BiteCode_dev 7y ago
  Yes, they almost own the entire JS ecosystem at this point. They lost a decade of battles for the web, but it seems they just found a way to get back in the fight. Now at the IE 6 times, that meant monopoly, and it was terrible news. But today, it means more competition between the giants, which is very good for us.
  - sbarre 7y ago
    One could argue that the IE6 of our times is Google Chrome at this point..
    - 7y ago
zozbot234 7y ago
It's on there already. https://github.com/npm/ https://github.com/npm/ and https://github.com/npm/cli https://github.com/npm/cli
- applecrazy 7y ago
  No, NPM the company is being acquired by Github.
brenden2 7y ago
This kind of consolidation is probably not good for everyone who depends on open source projects. Microsoft now owns a significant portion of software distribution.
fiberoptick 7y ago
Embrace, extend, extinguish.
- stephen82 7y ago
  Exactly! https://linux.slashdot.org/story/20/03/16/0137200/windows-subsystem-for-linux-2-will-include-a-microsoft-written-linux-kernel https://linux.slashdot.org/story/20/03/16/0137200/windows-su...
- JMTQp8lwXL 7y ago
  I can see why this comment is downvoted, because it's mostly superficial, but also, there's some truth to this perspective. Microsoft's acquisitions raise questions for what the open source ecosystem of tomorrow will look like. Chrome seemed to answer a lot of issues with browsers when it came out, but look how many people today are uncertain now that the API's powering the uBlock extension will be deprecated. It would be short-sighted for us to look at Chrome's history, and then say "nothing could ever happen to Open Source" without giving the perspective a serious consideration.
austincheney 7y ago
Is this a too big to fail kind of charity acquisition?
- markovbot 7y ago
  no, this is microsoft "embracing" (buying control of) a huge point of centralization in a software distribution ecosystem, positioning them to have greater power over a huge number of developers.
  - JMTQp8lwXL 7y ago
    Microsoft turned their reputation around in recent years with developers but I wonder how long it will last.
    - bepotts 7y ago
      I think people are "okay" with Microsoft because so many hackers have a problem with the data agglomeration and monetization strategy of Google and Facebook, but this Microsoft "embrace" will come to a head within the next couple years and I just can't wait for it. The way people think Microsoft's embrace of open source, GitHub, and now NPM is genuine is completely ridiculous. Microsoft had to change because much of where the action was is on *nix systems. Microsoft will start to use these companies to make developers embrace Microsoft services. It's only a matter of time.
      - KarlKemp 7y ago
        I can't even come up with a scenario of how MS would realistically do so? Sure, making GH actions easier to set up with Azure than AWS seems plausible, but also strikes me as somewhat benign. Banning python from Github? Requiring \r\n for NPM packages? What's the move you're afraid of?
        Vinnl 7y ago
        One question GitLab's CEO (sytse) is rightfully asking is whether the ability to trace code from npm back to the repository will be available to competitors. If not, less competition is bad for users. I still think this is good news, given where npm is coming from, but it's certainly not risk-free.
duxup 7y ago
I understand some folks trepidation but where was npm going anyway?
- CivBase 7y ago
  Am I weird for thinking it didn't need to go anywhere?
  - duxup 7y ago
    My understanding was that financially they were not going to last long doing what they were doing.
    - ThrowawayR2 7y ago
      That raises the question of how GitHub/Microsoft plan to profit off the acquisition though? It can't be just for goodwill or marketing.
      - dpacmittal 7y ago
        They own the ecosystem, they can leverage it in a lot of ways. And cost of running npm is drop in the ocean for a giant like MS.
      - ecnahc515 7y ago
        These companies don't need to profit off of acquisitions. If they're going to, it doesn't have to be direct either, it can be a method of growing their sales funnel if nothing else, or even just acquiring talent.
    - roguecoder 7y ago
      There's a difference between "not going to last long" and "not going to return 10x to their investors". This seems like another example of the faustian bargain of taking VC money.
      - 7y ago
K0nserv 7y ago
This seems like a good outcome overall. NPM being such an important pillar in the software supply chain while having an unviable business model and largely being funded by VC money was never a good position to be in. There are problems with more of the software ecosystem consolidating with a single entity but it still feels like an improvement.
- hinkley 7y ago
  It does have a bit of a 'value add' feel to it. But, you know, we've had decades of companies whose 'business model' is just their exit strategy...
- cycloptic 7y ago
  It was already consolidated. The vast majority of public npm packages are already hosted on Github. The dependency on them has been there since the beginning.
  - yjftsjthsd-h 7y ago
    I would expect that moving git repos is easier than replacing NPM?
    - cycloptic 7y ago
      It is, but who is doing that? The users of NPM all are choosing to stay on Github.
  - davnicwil 7y ago
    Yes, indeed - and the dependency is literally right there on the technical level. For years, you've been able to specify a version of a package as a github repo's branch HEAD. npm i some-package username/repo#branchName
    - ChristianBundy 7y ago
      Bonus points: npm install username/repo#semver:^1.2.3 The big problem is that lots of Node.js modules don't push their tags, so there are issues on lots of repos begging maintainers to push their Git tags so that we don't have to use the npm registry. JavaScript is an interpreted language -- as long as you're only downloading source code from the registry there's really no reason to use a registry instead of the plain old Git repository.
KaoruAoiShiho 7y ago
There's plenty of alternatives already so I don't see MS being able to do anything untowards. /shrugs, I'll panic only if something bad happens.
spacephysics 7y ago
https://en.m.wikipedia.org/wiki/Embrace,_extend,_and_extinguish https://en.m.wikipedia.org/wiki/Embrace,_extend,_and_extingu... Whelp, time to look for backup solutions for when Microsoft continues their strategy. Even today there’s an article about github flagging (re shadow banning) a user with 10k+ lib users, and no response from them as to why the ban occurred. Thinking of adding an “in case of emergency” link in my README for users in case of sudden service loss.
- fxtentacle 7y ago
  I wonder why your (entirely reasonable) comment got down-voted so much. This is exactly the risk why people prefer a distributed and decentralized internet over one where all open source is stored in one central Microsoft subsidiary (e.g. GitHub).
  - golf1052 7y ago
    I think people are tired of EEE being posted on every Microsoft related thread even though Microsoft has been a very different company for at least 10 years. I do agree with the concerns of open source consolidation though. We need to find better ways of supporting open source projects instead of having them being bought by "large company".
  - zdragnar 7y ago
    The central repository is entirely optional when using npm the cli tool; many companies use a proxy repository (such as artifactory) to host their internal packages and cache public ones already. Anyone can already run their own, or install from remote git urls (not just github) as well. If the new organization undermines the community, the community can easily move. NPM the company has had a significant number of missteps, and them getting better oversight and removing the need to be profitable will likely be better for everyone in the long run.
    - rootlocus 7y ago
      Not that many companies had proxies when leftpad was taken down.
sytse 7y ago
Thanks to Microsoft/GitHub for this acquisition. NPM is essential to the Javascript eco-system and it is hard to have a business model for just a registry. In the ruby eco-system the awesome Ruby Together https://rubytogether.org/ https://rubytogether.org/ was started to run the registry. In this case one of the worlds most valuable companies will run it, which means it doesn't need a not-for-profit. Regarding "trace a change from a GitHub pull request to the npm package version that fixed it" will there be an API to add a source in case the change was made outside of GitHub? Although I recognize that the vast majority of changes to npm packages happen on GitHub.
- tenderlove 7y ago
  Just to clarify, RubyCentral http://rubycentral.org http://rubycentral.org is running the RubyGems registry.
  - jrochkind1 7y ago
    It's confusing. RubyCentral pays for hosting and "ops" (not sure how much 'ops' staff time, if any?), but I think not development? And RubyTogether hypothetically pays for development (some but not neccesarily all that's needed), which can include new features but also required maintenance (we all know software requires care and feeding, it's never "done")? But I could have this not right? It has been confusing for a variety of reasons. And I think there are mixed reviews with how well it's going overall, especially the RubyTogether part.
  - sytse 7y ago
    Thanks for that clarification, I was not aware of that. Thanks RubyCentral!
- Vinnl 7y ago
  That must make you nervous over at GitLab, no? GitLab's integrated workflow is one of its main selling points (I love it), and GitHub now seems to be well underway to cross that moat.
  - 7y ago
franciscop 7y ago
I'm surprised there's not a single mention of "Microsoft" in this or the npm announcement [1], given the old-evil-history of Microsoft and the new-nice Microsoft we have today. I would expect that there was at least a mention, considering the reason that most modules in npm are still in ES5 is exactly because of the monopolistic practices that Microsoft followed back in the day which makes Internet Explorer still relevant. Not negative, not positive comment. Just surprising there was no mention. And I do think Microsoft is doing a great job recently with Open Source in general. [1] https://blog.npmjs.org/post/612764866888007680/next-phase-montage https://blog.npmjs.org/post/612764866888007680/next-phase-mo...
- whoisjuan 7y ago
  I mean. It's a subsidiary. I understand your sentiment but mentioning Microsoft would be like signaling that GitHub doesn't have any autonomy which is quite the contrary to what Microsoft said when buying it. So don't expect sudden sincerity on this. There's a reason why they haven't added Microsoft branding to areas like the footer.
  - fxtentacle 7y ago
    ... and everyone knows that big corporations always speak purely from their open heart when they sign large acquisition deals.
    - tylerchilds 7y ago
      well now I do ;)
- banachtarski 7y ago
  I installed Windows Subsystem for Linux 2 on an older machine just now. The MSFT of today is definitely a far cry from the MSFT of yesteryear. Such a thing would have been unheard of 15 years ago.
  - fredsted 7y ago
cpr 7y ago
Interesting subtle implications that the NPM paying users are going to be moved to Github's distribution system, while maintaining the OSS version of NPM for everyone else.
fxtentacle 7y ago
Oops. So NPM will go down, soon. I just finished reading this related HN post "How GitHub blocked me (and all my libraries)" https://news.ycombinator.com/item?id=22593595 https://news.ycombinator.com/item?id=22593595
- triceratops 7y ago
  There's a difference between NPM the client and NPM the registry. You can point the client to any registry you want - there are a ton of options.
  - mceachen 7y ago
    What other public registries are there, besides yarn's mirror of npm's registry?
    - triceratops 7y ago
      I didn't say public registries.
sergiotapia 7y ago
I'm not liking the consolidation. Never ends well, ever. Not even in one case in the history of humanity. I'll be switching from Github to other providers for my own projects, and use a different editor soon (using vscode now).
bepotts 7y ago
Gotta respect how Microsoft couldn't build anything the open source community wanted to work with/on so instead they used their Windows and Office monopoly to buy everyone's favorite playgrounds.
- mythz 7y ago
  They should get props for TypeScript & VSCode.
  - bepotts 7y ago
    They do and I will give them props for that. But no company should have as much control over open source that Microsoft does.
    - mythz 7y ago
      They should & deserve to have full control over everything they've created. You can blame AWS/GCP for letting GitHub & npm be acquired, how many years were they on the open market? Most of the $$$ in OSS is being funneled towards rent-seeking major cloud providers that are hosting OSS software, whom should all have blank checks with the money they've reaped so far, but seems only Microsoft has the strategic savvy to focus on acquiring the obvious targets for increasing dev mindshare. I don't fault them for their M&A's, it's just good business.
      - roguecoder 7y ago
        It's also not like Amazon is being an amazing open source citizen; I don't see them acquiring the tech to be an automatically-better outcome than the current version of Microsoft doing so. IMO this shows the importance of separating technology from platform. Ideally we would have non-profit groups with good governance & corporate support (rather than control) to grow these technologies. If an open source project can be acquired, it's only so free.
  - lioeters 7y ago
    Indeed, these two projects alone have turned around my long-held opinion on Microsoft, to "cautiously optimistic". TypeScript and VS Code have been an invaluable contribution to the community. I'm a daily user of both and so thankful for the talent, ingenuity and effort that have gone into them. How Microsoft have managed the acquisition of GitHub, giving them autonomy and infrastructure support - so far, it's been all around positive. Now with NPM under their wings, the centralization does worry me somewhat. I hope there are conscientious decision-makers who will guide the project for the good of community and ecosystem.
debt 7y ago
Thank god. NPM is so crappy it desperately needs institutional support.
nathcd 7y ago
<tangent> Sometimes I wonder what the business world (and the internet) would be like if mergers and acquisitions weren't allowed. Like, if businesses had to be sustainable or they'd just die, rather than capturing a whole market while eating VC money, maybe we'd all be better off? All of the really embarrassing stuff coming out of SV would just go away? Just Pinboards and Sourcehuts and Mastodons ruling the web? I'm capitalistically illiterate, so somebody please tell me why this thought is stupid.
- cortesoft 7y ago
  What would happen to all the tech, equipment, and employees after the company goes out of business? We have to burn it? If we did that, it would be a crazy waste of resources. The alternative is to let another company buy the stuff... and if a company buys the failed company's tech, equipment, and hires their staff... that is basically the same as buying the company.
  - nathcd 7y ago
    I mean, what would normally happen is employees look for new jobs, equipment is sold, and tech is thrown away (or open sourced in rare cases). Doesn't this already happen all the time?
    - cortesoft 7y ago
      It happens when no one wants the tech... but if it has value, it will be sold at liquidation time.
ginko 7y ago
Am I the only one surprized that there's an npm Inc. to be acquired? Why is there a for-profit corporation behind every open source project these days?
cfv 7y ago
Microsoft does have a much better track record in terms of keeping their products alive than other Way Way Large companies that could have made this acquisition, and for that I'm pretty glad. That said, and just in case their notoriously warlike legal team manages to fumble this somehow, I'd like to take the opportunity to remind every other frontender that Verdaccio (https://verdaccio.org/ https://verdaccio.org/) exists, is easy to implement, and relatively low maintenance.
TAForObvReasons 7y ago
NPM's blog post: https://blog.npmjs.org/post/612764866888007680/next-phase-montage https://blog.npmjs.org/post/612764866888007680/next-phase-mo...
ezekg 7y ago
Sorry, but npm burned me too many times. It is (was?) the worst package manager I've ever used. Not a fan of npm the company either. I'm sticking with yarn.
- joshiefishbein 7y ago
  Yarn is majorly only a CLI. It still uses NPM as the source for most packages. The product Github is probably most interested in is NPM as a repository for packages, not its CLI.
cjamesd 7y ago
Most important question: Will you still be able to see user-submitted phrases explaining the npm acronym? (See upper left-hand corner of https://www.npmjs.com/ https://www.npmjs.com/)
- ethomson 7y ago
  Yes, I love those. We'll keep those around for sure.
- kyle-rb 7y ago
  Damn, someone just beat me to "Now Part of Microsoft" https://github.com/npm/npm-expansions/pull/2936 https://github.com/npm/npm-expansions/pull/2936
mythz 7y ago
Just like GitHub this is a cloud play to make Azure more appealing by meeting developers where they're at, increase dev mindshare/reach, hosting their packages, CI Scripts/Actions then making it seamless to deploy to Azure. Smart, have no idea where AWS or GCP's control team are at when these strategic plays are going down.
- Jaxkr 7y ago
  I honestly think that Google cloud platform will be shut down within a couple years. It seems like it’s losing the war very badly.
  - IceWreck 7y ago
    I am honestly amazed that there is no official way to install Fedora or Fedora CoreOS on GCP. There are no images even on the GCP marketplace. Stuff like this is what irritates me. Even small vps providers have this.
pavlov 7y ago
Heh, I called this 10 months ago: https://news.ycombinator.com/item?id=19838122 https://news.ycombinator.com/item?id=19838122 Somebody replied "Microsoft won't acquire npm for sure."
- bbrree66 7y ago
  Wow, congrats! You are amazing! I can't believe someone disagreed with your prediction.
- RuleOfBirds 7y ago
  Neat contribution! You guessed one thing, someone else guessed another, but they were wrong, and you were right! Yay on @pavlov. Boo on them.
  - pavlov 7y ago
    A special day. The stock market is down 388% and 142% of people are predicted to die, but I got Internet karma points for guessing something right and that's what really counts.
- russellbeattie 7y ago
  I used to be excited when I made predictions like that. Then I realized that my correct predictions, plus $4.15, would only get me a Venti Latte at Starbucks.
- deleted 7y ago
  [deleted]
Jaxkr 7y ago
This is pretty great. NPM was struggling to monetize and is a critical part of the JavaScript ecosystem.
rtsao 7y ago
I hope this doesn't alter the current GitHub npm package registry policy where all packages must be published under a scope corresponding to name of the owning GitHub user/org. The resulting increased transparency and clarity of ownership will be great for the JS ecosystem. The existing npm ownership model is markedly less clear and has led to several problems, including the transfer of package publishing rights to bad actors without anyone being aware. On the whole, npm accounts and orgs were always just an unnecessary abstraction that obscured the actual provenance of software, of which GitHub is the de facto source.
- toastal 7y ago
  Does this mean using alternatives (GitLab, et. al) is not an option? The worst option has been Elm's system where the whole package system requires you to not only use GitHub, but when GitHub in down (which isn't uncommon unfortunately) packages that weren't cached locally were inaccessible with no mirroring options.
- clarkbw 7y ago
  Yes thank you! We believe namespaces are a good thing and will continue to promote it as best practice. Hopefully we can integrate repository information to packages meta data such that you could be aware of a change of ownership even for a globally namespaced package.
- ocdtrekkie 7y ago
  I think this is the big reason I'm excited about NPM joining GitHub. I don't trust NPM (I'm not fond of package repos in general), but tying packages closely to their GitHub source offers significantly more verification potential that a package is in fact comprised of the source code for it, and that it hasn't recently turned hostile.
bjt2n3904 7y ago
You know, my initial reaction was... oh no, the toxic people who run NPM and Node.js[1][2] are going to infect GitHub. But then I read that other front page article about the guy that got mysteriously "flagged", and the invasive questions he was asked. Maybe Github is already too far gone. Maybe it should be... please, bundle all the toxic people together in one spot, and let it all come crashing to the ground. I've had serious reservations about using Node.js in a product I've been tasked to work on, for the reasons I listed below. It'd be great if they just... ceased to exist. 1 - left-pad incedent 2 - The Ayo fork drama
- rattray 7y ago
  Wishing ill on others or their projects ("it'd be great if they ceased to exist") does not reduce toxicity.
waydowntogo 7y ago
RIP NPM
jxub 7y ago
NPM is joining GitHub, GitHub joins Microsoft, Microsoft joins... ;)
thawkins 7y ago
Time to get behind Deno https://en.m.wikipedia.org/wiki/Deno_(software) https://en.m.wikipedia.org/wiki/Deno_(software) Built by the node team to replace node.
ilaksh 7y ago
For how much money I wonder.
ryanmarsh 7y ago
How much did Microsoft pay? What did the founders take away? Most people don’t know, in these open source acquisitions by for profits there’s money involved and “founders” get an exit. Not always clear To the public who those are or what they took home from a mostly volunteer effort.
- lioeters 7y ago
  I too was curious about how much the acquisition cost. According to TechCrunch: > GitHub, the developer repository owned by Microsoft, made a little deal of its own this morning when it bought JavaScript packaging vendor npm for an undisclosed amount. https://techcrunch.com/2020/03/16/github-nabs-javascript-packaging-vendor-npm/ https://techcrunch.com/2020/03/16/github-nabs-javascript-pac...
29athrowaway 7y ago
Hopefully they don't drop Linux support like they did with Skype, Minecraft, Xamarin[1], Corel Office and a long list of products. Their strategy from my perspective is to ensure Linux does not become a competitor for their desktop OS. 1: it never had Linux support.
- chungy 7y ago
  Skype returned with a Linux client, and Minecraft never dropped Linux support at all.
  - 29athrowaway 7y ago
    Minecraft for Linux does not have the same features.
    - chungy 7y ago
      What features are you talking about? It literally uses the same launcher and same jar files. It's exactly the same game.
no_wizard 7y ago
I see this as a straightforward play, simply put, I think (to summarize, perhaps a little to broadly) - They want to sell Azure Services - Most (if not all) NPM packages already live on github - NPM has a business revolving around package management, including private npm instances and increasingly around node/package security - This being primarily a business that will sell to has-money businesses (e.g., medium to large businesses, Fortune 500 corporations etc) So, given all of the above, it makes sense to have a vertical selling into one of the fastest growing package management ecosystems where you can be the "full stack" provider of developer/enterprise tools. I don't think its anything beyond this, personally. I expect to see a lot of pushes to integrate with Azure Pipelines, cloud deployment etc. centered around this. I wonder if they'll buy Passenger[0] next, its a popular (in my experience) to deploy nodejs applications. [0]https://www.phusionpassenger.com/library/ https://www.phusionpassenger.com/library/
inputError 7y ago
THANK FUCKING GOD
nojvek 7y ago
Github announced the Github packages feature a while back, but without npm it didn't quite make sense. Acquiring npm means github not only hosts source code, but packages as well. With Github Actions, they want to be the one stop shop for code lifecycle and be at the forefront of javascript ecosystem. If developers love Github, they love the cloud. Microsoft is betting big on the cloud, they lost the Mobile war but they definitely want to be the developer and cloud darlings.
worik 7y ago
Perhaps they will do the right thing and shut it down
flanbiscuit 7y ago
I wonder if more people will look into adopting Deno[1], the new node alternative by one of the creators of Node. It does not use NPM, you pull in packages Go-style (via URLs[2]). It's supposed to be more secure because you have to explicitly give it access to anything (i.e. network, file system, etc). [1] https://deno.land/ https://deno.land/ [2] example import in Deno: import { serve } from "https://deno.land/std@v0.36.0/http/server.ts"; Previous HN about Deno: https://news.ycombinator.com/item?id=22102656 https://news.ycombinator.com/item?id=22102656
- wwweston 7y ago
  The thought that's going into Deno about permissions and upstream package issues have me considering it where I've generally rejected node.js for anything serious (also recognizing that it's probably early for production use).
- threatofrain 7y ago
  Is deno debugging there yet?
- ledgerdev 7y ago
  Node+NPM isn't going anywhere, but Deno sure seems like the server based runtime of the future.
- miohtama 7y ago
  Deno truly seems interesting. Especially native TypeScript ability. Who is backing the project in this point?
breatheoften 7y ago
(Wishful thinking ...) Does this mean the next release of npm will be yarn v2 and that typescript will implement support for the pnp spec so we can converge the javascript packaging space to a sane place?
- Vinnl 7y ago
  There already is a Yarn v2: https://dev.to/arcanis/introducing-yarn-2-4eh1 https://dev.to/arcanis/introducing-yarn-2-4eh1
  - breatheoften 7y ago
    Does typescript support pnp somehow now? (That's actually the thing I'm wanting ...). npm's cli going away was an attempted tease (in bad-taste i think)
skrebbel 7y ago
Assuming this was an acceptable exit: I'm impressed that NPM pulled this off. They were basically doing the "no revenue model to speak of, hope we'll get acquired by a bigco" startup play that was starting to go out of vogue already when they were founded. I wonder to what extent they've had influence over their own success at all though. Basically they had to hope that JS stayed popular (it did), that Node stayed relevant (it did) and that the entire JS ecosystem would move over to NPM (it did, but I'd say rather despite NPM than because of it) (I mean, otherwise Yarn wouldn't even exist, right?). So basically their bet was: - Turn NPM into a startup - Keep the lights on I bet I'm missing all kinds of key behind-the-scenes stuff, but still, I don't know many startups that manange to successfully exit by "just" keeping the lights on. In a weird cringey way, it's motivating.
- daveisfera 7y ago
  Neither side is announcing a price and NPM has been struggling financially for a while, so the likelihood that it was a "good exit" is low.
- zomglings 7y ago
  Not sure how good an exit it was. Crunchbase says they have fewer than 50 employees [0], so I'm guessing the first 10 people did pretty well but that the rest got what amounts to a nice bonus. Keeping the lights on long enough makes this kind of exit more likely. Paul Graham has a good article about this: http://www.paulgraham.com/die.html http://www.paulgraham.com/die.html NPM did better than "just" keeping the lights on, though. They even held Yarn at bay by adopting its best features very quickly. [0] https://www.crunchbase.com/organization/npm https://www.crunchbase.com/organization/npm
- tdumitrescu 7y ago
  Here's what isaacs writes in the NPM blog post (https://blog.npmjs.org/post/612764866888007680/next-phase-montage https://blog.npmjs.org/post/612764866888007680/next-phase-mo...). It doesn't seem like anyone on the NPM team did great financially from this: "I have a set of goals that I wrote down back then, and have shared openly with the team. ... 3. Get a big enough exit that I can quit my job and see what comes out of me a second time. 4. Share the rewards equitably with the people who got npm to where it is. ... On (3), well, I’m still working a jobby job, but I always knew that was a long shot, and “make npm a better package manager” is a job I enjoy. And as for (4), I’m proud of the deals that we’ve been able to negotiate for the team. It’s not a kajillion billion dollar 10x startup cinderella story, and we’ve taken our hits, but in the end we’ve done right by our community, team, and careers, and I’m extremely proud of what we’ve achieved."
collyw 7y ago
I hope it's not going to do a left-pad fiasco on everything in github.
mekoka 7y ago
Next in line is Canonical.
mtkd 7y ago
Mid Oct 2009 -- Github ceased gems.github.com to focus on source control
okareaman 7y ago
I'd like to see Microsoft bring Ryan Dahl (original author of node) back in the fold by sponsoring/buying Deno with TypeScript. It's a good fit.
hn_throwaway_99 7y ago
Current me loves this, and I love all the GitHub tools they've added recently. Future "5-10 years down the road" me knows this will suck, ending up where all concentrated monopolies end up...
talawahtech 7y ago
Ok now Microsoft just needs to acquire what remains of Docker and their Developers, Developers, Developers, Developers collection will be complete.
throwaway78359 7y ago
Microsoftie here — throwaway for obvious reasons. Microsoft doesn’t do everything right but the GitHub acquisition has honestly gone better than I ever expected. Rather than forcing GitHub to adopt Microsoft centric policies, Microsoft has adopted more GitHub stuff, especially from a product POV. GitHub still runs as a separate company (different logins and health care and hiring systems) with its own policies and point of view. The reality is npm was in a bad place and in a land of not good options, this strikes me as the best possibility. I’d rather have GitHub control this and be able to give the resources to npm than a company like Oracle or Amazon or even Google or Facebook to own it. In a perfect world, some independent entity could fund npm out of gratitude but at the same time, consider how poorly npm as a company was run for YEARS and the general lack of direction. So yeah, I’m cautiously optimistic this won’t be fucked up by GitHub — but I understand the concern. As for those worried about Microsoft embracing, extending, and extinguishing. Lol. Even if that was the goal (and I truly don’t think that’s the ethos at all any more), Microsoft is laughably incompetent at achieving that sort of strategy. Google and Amazon have the EEE under lock right now (Facebook too — let’s be glad Zuck didn’t buy this after we saw what happened to yarn), but Microsoft can’t even put coherent dev strategy outside of .NET on Azure.
- skrebbel 7y ago
  > after we saw what happened to yarn I missed something, what happened to Yarn?
  - purplerabbit 7y ago
    Second this. It still seems to be working fine... (actually, better than npm last I checked)
  - pkilgore 7y ago
    The maintainer released Yarn 2. Yarn 2 is pretty foundationaly different than Yarn 1, and can and does break a lot of products/projects if used. Some folks are not happy about it, although Yarn 1 will probably continue to be maintained by the community for a while. This seems to be pretty fair about the whole thing: https://shift.infinite.red/yarn-1-vs-yarn-2-vs-npm-a69ccf0229cd https://shift.infinite.red/yarn-1-vs-yarn-2-vs-npm-a69ccf022...
dzonga 7y ago
in as much as I love Github, putting our eggs in one basket as developers is gonna burn us soon or later. we need redundancies in the system, that if one thing goes down, the world can go on as normal. now we're centralizing github as a single failure point. we've already seen the the panic outages of Github or S3 cause.
Phenix88be 7y ago
I'm always worried when thing like this happen : Critical open source entities are bought by private company. I understand the need for money and sustainability these entities need, but it's really a shame that the open source community doesn't "own" themselves.
abledon 7y ago
what does this mean for yarn?
ryanmccullagh 7y ago
Microsoft owns so may day-to-day tools and platforms. LinkedIn, GitHub, NPM.
hateful 7y ago
They could probably save tons just by deduping the npm and github homepages of every package!
Kenji 7y ago
You naive idiots. You just sold the keys to the JavaScript kingdom to Microsoft.
thulecitizen 7y ago
Yay more centralization! What could possible go wrong with critical components being hosted by one big corporation?
craftyguy 7y ago
title should be "microsoft acquires NPM"
znpy 7y ago
this should really be titled "npm is joining Microsoft"
thunderbong 7y ago
Ok, everyone seems to be beating up on Microsoft per the top comment here. I have a counter point - Does anyone ever think what would happen if Microsoft were to disappear tomorrow? How would you get your drivers license? How would you process your mortgage? How would you go about buying tickets for anything? How would you get your groceries and food? Are we expecting everyone to run Linux? Or shall we say, Ubuntu? Or was it Mint? Can we decide on a specific desktop OS? Can we? Can we pick up a USB wifi dongle or connect a printer and expect it to work? Are you frikkin kidding me? We'd be running around like chickens with their heads cut off. Get over it, all of you. Frikkin grow up. We've had the thirty years since Linux came on the scene. And what have we done? You'll say - "we've got the server market". Sure. And what is that? Ubuntu, right? Give me a break. If it wasn't for Mark Shuttleworth, even that wouldn't have been there. We want to be kids. We want to play with our toys in our corner of the room throughout our lives and we want others to clothe and feed us for free. That's what we want. We want to share, but don't want others to make money off it. And what happens? A big corporate comes around giving everything away for free, and we all grab it with both our hands. And 15 years later, we cry that the corporate has gone evil. We keep complaining about Microsoft on Hacker News, typing on Apples and iPhones and Androids. Are you all delusional? Are you all blind? There is NOTHING free in this world, including lunches. People pay for things that will work together seamlessly, that takes the least effort to work with. Why? Because software, programs, operating systems are not the end of the world, life is. There are more important things in life that tabs or spaces, or carriage returns and line feeds. And the only way that can happen, when someone says I'll give $X for Y and you give him Y, rather than twiddling around with Z. I've had battles with Microsoft by way of IE. I've also battled with Linux. Major battles. But the battles I've had with Microsoft, I got paid for. The battles with Linux? Well, maybe I got music playing on my laptop. Only on mine, mind you! I think it's time we admitted to ourselves, that we can't decide on anything collectively. I think it's time we stopped being cranky, demanding, tantrum throwing children. We'll all die soon and everyone will be paying for software as a service and we'll all be old farts talking about the good old days, when we could download a program, modify it and run it only on our system. I'm tired of all your hangups. Holding on to decade old grudges. Dreaming about the glorious future of software that just might have existed if everyone had just the same idea as you. Grow up, open your eyes, get a life. Stop being so self-centered and churlish. Stop trying to see flaws everywhere except yourself. Stop trying to complain about open source everywhere and see that all kinds of software need to exist. Go out. Do good for someone. Get paid for it. Come back home. Enjoy dinner with your family. Get a good night's sleep.
aikah 7y ago
Who predicted it 5 month ago? hmm? https://news.ycombinator.com/item?id=21031266 https://news.ycombinator.com/item?id=21031266 I also predicted a few more controversial things but if you think it terms of ecosystem and cloud market strategy, then it makes perfect sense.
z3t4 7y ago
Was gonna write about all the bad stuff that can happen, but don't want to give any ideas. Instead I give advice; embrace and empower, rather then extend and extinguish.
rambojazz 7y ago
What are they buying, precisely? Open source software?
goofballlogic 7y ago
A sad day I think. I wish more independent ecosystems were evolving, instead of consolidating.
papito 7y ago
You are all Microsoft developers now :)
rodgerd 7y ago
Microsoft have been making their code analysis tools available in GitHub post-aquisition; doing the same for npm could really help improve the risks JS programmers face when pulling in libraries from npm.
mekster 7y ago
What I'd hope : Somehow make packages more secure than hoping that nothing is tainted in the dependency. I think this is the biggest issue of volunteer package repo. What I'd not hope : MS changes strategy with change of people etc and npm and GitHub rot.
justlexi93 7y ago
Happy to hear this. Microsoft has been doing a great job with Github IMO.
hrjd 7y ago
At anytime in the future, the product might have licensing gotchas to run elsewhere than Microsoft cloud products. This is already happening with Windows and SQL server licensing. This will happen sooner or later.
pmwatson 7y ago
After how Microsoft have handled GitHub I'm not worried. However even a non-.NET web-developer now could be using quite a bit of Microsoft owned tech; VSCode GitHub npm Azure
lucaspottersky 7y ago
WHAT. A. JOKE.
larodi 7y ago
i didn't so far realized that npm was a company, and not a tool . wow.
classified 7y ago
So essentially, Microsoft has bought npm. Smart move. Seeing that node.js builds on top of Googleware, this is not the worst that could have happened.
1337shadow 7y ago
Any npm alternative yet ?

1829 points by mholt 7y ago

petey283 7y ago

I worry that this is too much consolidation.

Analemma_ 7y ago
I hope you're spending lots of money at independent places then, because this is the inevitable result of the current "OSS infrastructure funded by VC charity" model. NPM was losing money, as was GitHub when Microsoft bought that. Under such conditions, getting bought out by a megacorp is the only path forward.

sandov 7y ago

"Github acquires npm" would be a better title IMO.

kdaigle 7y ago
Today we've announced that we've signed an agreement to acquire NPM but we technically have not acquired them yet (referred to as "closed"). NPM is still their own company for now and that's why the language is future tense.
- sandov 7y ago
  "Github is acquiring npm" then. "NPM is joining Github" sounds like you're just using Github to host your stuff.
  - Conan_Kudo 7y ago
    Using the "is joining" phrasing is a classic way to try to spin an acquisition as some kind of partnership. 99% of the time, it's definitely not.
  - rdiddly 7y ago
    I literally thought that, clicked hide, then thought "Wait a minute, do they mean...?" and had to go fish it out of hidden items. "Joining" is an interesting term here... but I suppose it won because it sounds more like something friendly humans would do. "NPM Is Breaking Bread and Sharing with Github as Special Friends."
- TheKarateKid 7y ago
  Then saying "GitHub is acquiring NPM" would've been a more accurate way to say this.
hinkley 7y ago
I am glad that the npm team will finally have some adult supervision. Meanwhile, I almost have my team switched to yarn.
- Normal_gaussian 7y ago
  yarn v1+ or yarn v2/berry? Switching to berry has been a huge PITA over here, but I don't want to give up workspaces
  - hinkley 7y ago
    Our 'workspace' is so ornate that yarn couldn't handle it. 1.21+ almost looks right, but something very bad is still going on with mocha deduping, such that tests are failing with really bizarre error messages. I check yarn about every three months, or when I find a new, infuriating bug with the npm CLI (so, every couple of months on average). I think npm install suffers greatly from not having a formal spec. It has been bugfixed by so many different individuals now that it has reached a truly astounding level of schizophrenia. If yarn didn't exist, I would have started trying to break down the install problem into many independent concerns that can be reasoned about individually and tried to solicit help in making a full installer out of it. If I'd known I'd still be trying to make yarn workspaces work for us 18 months later I probably would have. Node modules in general have some bad patterns of delegation that are utterly antagonistic to self-documentation, and both yarn and npm seem to suffer from this as well. I think in the next week or so I'm going to have to set up a small test case that exhibits the yarn bug I'm seeing, or any of the half a dozen interlocking (emphasis on 'lock') npm bugs that now have me painted into a very tiny corner.
    - IsaacSchlueter 7y ago
      Your take on the installer in npm v6 is not wrong. It got that way by a process of gradual iterative evolution, and it has lots of warts. npm v7 features a ground-up rewrite of the tree resolution and deification logic in the @npmcli/arborist module. I recommend checking it out, or at least staying tuned for the beta coming soon.
  - 7y ago
ProAm 7y ago
"Microsoft acquires npm"
Verdex 7y ago
Yeah, I was confused when I first heard of it because it seems like an odd couple to "join" one another. However, it makes perfect sense for github to purchase npm.

jrimbault 7y ago

Interesting transitive ownership/dependencies here.

simlevesque 7y ago

I did not see that coming. I trust Microsoft to be able to offer great availability and nice software. It is maybe not the best overlord we could have hoped for but it's way better than the status quo.

dubcanada 7y ago

Wait, so is it joining Microsoft? Or is it under Github, which is under Microsoft? I don't fully understand the way it's governed from this article.

clarkbw 7y ago
Part of GitHub (I work at GitHub and lead the Packages team)
- cmckn 7y ago
  How does this acquisition relate to Package's support of npm artifacts? Or, I guess, how will Package's npm support change after this?
  - clarkbw 7y ago
    The post covers this. > Later this year, we will enable npm’s paying customers to move their private npm packages to GitHub Packages—allowing npm to exclusively focus on being a great public registry for JavaScript. Packages will continue to develop its npm registry. We have a lot of work to do in securing the software supply chain.
- mceachen 7y ago
  Can I be so bold as to suggest a new feature? It'd be wonderful, as a package consumer, to have visibility into some security metrics for a given package. This would be useful both at initial install time, and when the package is upgraded. Something like: 1) who are the latest commits GPG signed by? 2) is the package publisher using 2FA? 3) what is the security profile of all dependent packages? 4) are there any new authors (directly or via dependencies) since the last version (with links to the author and their contributions). These might help avoid prior situations where popular packages get injected with malware by new maintainers.
  - clarkbw 7y ago
    Yes, we (internally) call this a "Bill of Health" and believe that all packages should have this kind of diff-able information available. Understanding what's happening at the source level is key to being able to trust any package published.

Brendinooo 7y ago

I occasionally forget that Microsoft bought GitHub. They certainly don't do anything here to remind me of that fact. How separate from MS has GitHub been in day-to-day operations?

owenwil 7y ago
GitHub employees have access to Microsoft internal tools and a Microsoft email address, so I don't think there's too much internal firewalling.
reilly3000 7y ago
I can't speak to company internals, but I do know that Azure is powering GitHub Actions runners, and there have been a firehose of new features coming out of GitHub in the past year. I imagine its pretty core to their "Developers Developers Developers" strategy.
deleted 7y ago
[deleted]
kdaigle 7y ago
I've been at GitHub for 7 years and we operate independently but have the support and resources of Microsoft when we need them. IMO, they've been amazing partners but day to day the GitHub team builds, prioritizes, and supports GitHub.
- nojvek 7y ago
  It's totally the smart thing to do. Github needs a ton of cloud compute with github actions, Azure powers it. Github brings a very strong brand that developers love, which gives Microsoft a good rep amongst technical folks. This is as good as Google acquiring Youtube because Youtube needs an insane amount bandwidth and it was a perfect fit for Google's infrastructure and ad platform. It's just sad to see Google not playing the Developers game well.
- bengale 7y ago
  Do you think they're going to try and push us towards azure more, or force us into using Microsoft logins?

batmansmk 7y ago

VsCode, Typescript, Github, NPM. And Microsoft doesn't even have to maintain the main runtime, Google does. What a clever strategy!

lucideer 7y ago
In fairness to Microsoft, they did at least spend a little bit of time considering / working toward maintaining the runtime part, before deciding otherwise https://github.com/nodejs/node-chakracore/issues/628#issuecomment-586139750 https://github.com/nodejs/node-chakracore/issues/628#issueco...
swyx 7y ago
to be clear, Chrome's overall value to Google probably dwarfs all those things combined.
sitkack 7y ago
They could fork it, the core of the runtimework is moving to WebAssembly anyway which is a much more tractable problem. Sure this is a boatload of JS work to do at the interface boundary but the amount of hard compiler and jit work that needs to be focused on by main runtime is much lower. Someone at MS knows strategic and tactics. When MS and Windows bootstrap themselves into the cloud, they will have some software to land on.
BiteCode_dev 7y ago
Yes, they almost own the entire JS ecosystem at this point. They lost a decade of battles for the web, but it seems they just found a way to get back in the fight. Now at the IE 6 times, that meant monopoly, and it was terrible news. But today, it means more competition between the giants, which is very good for us.
- sbarre 7y ago
  One could argue that the IE6 of our times is Google Chrome at this point..
  - 7y ago

zozbot234 7y ago

It's on there already. https://github.com/npm/ https://github.com/npm/ and https://github.com/npm/cli https://github.com/npm/cli

applecrazy 7y ago
No, NPM the company is being acquired by Github.

brenden2 7y ago

This kind of consolidation is probably not good for everyone who depends on open source projects. Microsoft now owns a significant portion of software distribution.

fiberoptick 7y ago

Embrace, extend, extinguish.

stephen82 7y ago
Exactly! https://linux.slashdot.org/story/20/03/16/0137200/windows-subsystem-for-linux-2-will-include-a-microsoft-written-linux-kernel https://linux.slashdot.org/story/20/03/16/0137200/windows-su...
JMTQp8lwXL 7y ago
I can see why this comment is downvoted, because it's mostly superficial, but also, there's some truth to this perspective. Microsoft's acquisitions raise questions for what the open source ecosystem of tomorrow will look like. Chrome seemed to answer a lot of issues with browsers when it came out, but look how many people today are uncertain now that the API's powering the uBlock extension will be deprecated. It would be short-sighted for us to look at Chrome's history, and then say "nothing could ever happen to Open Source" without giving the perspective a serious consideration.

austincheney 7y ago

Is this a too big to fail kind of charity acquisition?

markovbot 7y ago
no, this is microsoft "embracing" (buying control of) a huge point of centralization in a software distribution ecosystem, positioning them to have greater power over a huge number of developers.
- JMTQp8lwXL 7y ago
  Microsoft turned their reputation around in recent years with developers but I wonder how long it will last.
  - bepotts 7y ago
    I think people are "okay" with Microsoft because so many hackers have a problem with the data agglomeration and monetization strategy of Google and Facebook, but this Microsoft "embrace" will come to a head within the next couple years and I just can't wait for it. The way people think Microsoft's embrace of open source, GitHub, and now NPM is genuine is completely ridiculous. Microsoft had to change because much of where the action was is on *nix systems. Microsoft will start to use these companies to make developers embrace Microsoft services. It's only a matter of time.
    - KarlKemp 7y ago
      I can't even come up with a scenario of how MS would realistically do so? Sure, making GH actions easier to set up with Azure than AWS seems plausible, but also strikes me as somewhat benign. Banning python from Github? Requiring \r\n for NPM packages? What's the move you're afraid of?
      - Vinnl 7y ago
        One question GitLab's CEO (sytse) is rightfully asking is whether the ability to trace code from npm back to the repository will be available to competitors. If not, less competition is bad for users. I still think this is good news, given where npm is coming from, but it's certainly not risk-free.

duxup 7y ago

I understand some folks trepidation but where was npm going anyway?

CivBase 7y ago
Am I weird for thinking it didn't need to go anywhere?
- duxup 7y ago
  My understanding was that financially they were not going to last long doing what they were doing.
  - ThrowawayR2 7y ago
    That raises the question of how GitHub/Microsoft plan to profit off the acquisition though? It can't be just for goodwill or marketing.
    - dpacmittal 7y ago
      They own the ecosystem, they can leverage it in a lot of ways. And cost of running npm is drop in the ocean for a giant like MS.
    - ecnahc515 7y ago
      These companies don't need to profit off of acquisitions. If they're going to, it doesn't have to be direct either, it can be a method of growing their sales funnel if nothing else, or even just acquiring talent.
  - roguecoder 7y ago
    There's a difference between "not going to last long" and "not going to return 10x to their investors". This seems like another example of the faustian bargain of taking VC money.
    - 7y ago

K0nserv 7y ago

This seems like a good outcome overall. NPM being such an important pillar in the software supply chain while having an unviable business model and largely being funded by VC money was never a good position to be in. There are problems with more of the software ecosystem consolidating with a single entity but it still feels like an improvement.

hinkley 7y ago
It does have a bit of a 'value add' feel to it. But, you know, we've had decades of companies whose 'business model' is just their exit strategy...
cycloptic 7y ago
It was already consolidated. The vast majority of public npm packages are already hosted on Github. The dependency on them has been there since the beginning.
- yjftsjthsd-h 7y ago
  I would expect that moving git repos is easier than replacing NPM?
  - cycloptic 7y ago
    It is, but who is doing that? The users of NPM all are choosing to stay on Github.
- davnicwil 7y ago
  Yes, indeed - and the dependency is literally right there on the technical level. For years, you've been able to specify a version of a package as a github repo's branch HEAD. npm i some-package username/repo#branchName
  - ChristianBundy 7y ago
    Bonus points: npm install username/repo#semver:^1.2.3 The big problem is that lots of Node.js modules don't push their tags, so there are issues on lots of repos begging maintainers to push their Git tags so that we don't have to use the npm registry. JavaScript is an interpreted language -- as long as you're only downloading source code from the registry there's really no reason to use a registry instead of the plain old Git repository.

KaoruAoiShiho 7y ago

There's plenty of alternatives already so I don't see MS being able to do anything untowards. /shrugs, I'll panic only if something bad happens.

spacephysics 7y ago

https://en.m.wikipedia.org/wiki/Embrace,_extend,_and_extinguish https://en.m.wikipedia.org/wiki/Embrace,_extend,_and_extingu... Whelp, time to look for backup solutions for when Microsoft continues their strategy. Even today there’s an article about github flagging (re shadow banning) a user with 10k+ lib users, and no response from them as to why the ban occurred. Thinking of adding an “in case of emergency” link in my README for users in case of sudden service loss.

fxtentacle 7y ago
I wonder why your (entirely reasonable) comment got down-voted so much. This is exactly the risk why people prefer a distributed and decentralized internet over one where all open source is stored in one central Microsoft subsidiary (e.g. GitHub).
- golf1052 7y ago
  I think people are tired of EEE being posted on every Microsoft related thread even though Microsoft has been a very different company for at least 10 years. I do agree with the concerns of open source consolidation though. We need to find better ways of supporting open source projects instead of having them being bought by "large company".
- zdragnar 7y ago
  The central repository is entirely optional when using npm the cli tool; many companies use a proxy repository (such as artifactory) to host their internal packages and cache public ones already. Anyone can already run their own, or install from remote git urls (not just github) as well. If the new organization undermines the community, the community can easily move. NPM the company has had a significant number of missteps, and them getting better oversight and removing the need to be profitable will likely be better for everyone in the long run.
  - rootlocus 7y ago
    Not that many companies had proxies when leftpad was taken down.

sytse 7y ago

Thanks to Microsoft/GitHub for this acquisition. NPM is essential to the Javascript eco-system and it is hard to have a business model for just a registry. In the ruby eco-system the awesome Ruby Together https://rubytogether.org/ https://rubytogether.org/ was started to run the registry. In this case one of the worlds most valuable companies will run it, which means it doesn't need a not-for-profit. Regarding "trace a change from a GitHub pull request to the npm package version that fixed it" will there be an API to add a source in case the change was made outside of GitHub? Although I recognize that the vast majority of changes to npm packages happen on GitHub.

tenderlove 7y ago
Just to clarify, RubyCentral http://rubycentral.org http://rubycentral.org is running the RubyGems registry.
- jrochkind1 7y ago
  It's confusing. RubyCentral pays for hosting and "ops" (not sure how much 'ops' staff time, if any?), but I think not development? And RubyTogether hypothetically pays for development (some but not neccesarily all that's needed), which can include new features but also required maintenance (we all know software requires care and feeding, it's never "done")? But I could have this not right? It has been confusing for a variety of reasons. And I think there are mixed reviews with how well it's going overall, especially the RubyTogether part.
- sytse 7y ago
  Thanks for that clarification, I was not aware of that. Thanks RubyCentral!
Vinnl 7y ago
That must make you nervous over at GitLab, no? GitLab's integrated workflow is one of its main selling points (I love it), and GitHub now seems to be well underway to cross that moat.
- 7y ago

franciscop 7y ago

I'm surprised there's not a single mention of "Microsoft" in this or the npm announcement [1], given the old-evil-history of Microsoft and the new-nice Microsoft we have today. I would expect that there was at least a mention, considering the reason that most modules in npm are still in ES5 is exactly because of the monopolistic practices that Microsoft followed back in the day which makes Internet Explorer still relevant. Not negative, not positive comment. Just surprising there was no mention. And I do think Microsoft is doing a great job recently with Open Source in general. [1] https://blog.npmjs.org/post/612764866888007680/next-phase-montage https://blog.npmjs.org/post/612764866888007680/next-phase-mo...

whoisjuan 7y ago
I mean. It's a subsidiary. I understand your sentiment but mentioning Microsoft would be like signaling that GitHub doesn't have any autonomy which is quite the contrary to what Microsoft said when buying it. So don't expect sudden sincerity on this. There's a reason why they haven't added Microsoft branding to areas like the footer.
- fxtentacle 7y ago
  ... and everyone knows that big corporations always speak purely from their open heart when they sign large acquisition deals.
  - tylerchilds 7y ago
    well now I do ;)
banachtarski 7y ago
I installed Windows Subsystem for Linux 2 on an older machine just now. The MSFT of today is definitely a far cry from the MSFT of yesteryear. Such a thing would have been unheard of 15 years ago.
- fredsted 7y ago

cpr 7y ago

Interesting subtle implications that the NPM paying users are going to be moved to Github's distribution system, while maintaining the OSS version of NPM for everyone else.

fxtentacle 7y ago

Oops. So NPM will go down, soon. I just finished reading this related HN post "How GitHub blocked me (and all my libraries)" https://news.ycombinator.com/item?id=22593595 https://news.ycombinator.com/item?id=22593595

triceratops 7y ago
There's a difference between NPM the client and NPM the registry. You can point the client to any registry you want - there are a ton of options.
- mceachen 7y ago
  What other public registries are there, besides yarn's mirror of npm's registry?
  - triceratops 7y ago
    I didn't say public registries.

sergiotapia 7y ago

I'm not liking the consolidation. Never ends well, ever. Not even in one case in the history of humanity. I'll be switching from Github to other providers for my own projects, and use a different editor soon (using vscode now).

bepotts 7y ago

Gotta respect how Microsoft couldn't build anything the open source community wanted to work with/on so instead they used their Windows and Office monopoly to buy everyone's favorite playgrounds.

mythz 7y ago
They should get props for TypeScript & VSCode.
- bepotts 7y ago
  They do and I will give them props for that. But no company should have as much control over open source that Microsoft does.
  - mythz 7y ago
    They should & deserve to have full control over everything they've created. You can blame AWS/GCP for letting GitHub & npm be acquired, how many years were they on the open market? Most of the $$$ in OSS is being funneled towards rent-seeking major cloud providers that are hosting OSS software, whom should all have blank checks with the money they've reaped so far, but seems only Microsoft has the strategic savvy to focus on acquiring the obvious targets for increasing dev mindshare. I don't fault them for their M&A's, it's just good business.
    - roguecoder 7y ago
      It's also not like Amazon is being an amazing open source citizen; I don't see them acquiring the tech to be an automatically-better outcome than the current version of Microsoft doing so. IMO this shows the importance of separating technology from platform. Ideally we would have non-profit groups with good governance & corporate support (rather than control) to grow these technologies. If an open source project can be acquired, it's only so free.
- lioeters 7y ago
  Indeed, these two projects alone have turned around my long-held opinion on Microsoft, to "cautiously optimistic". TypeScript and VS Code have been an invaluable contribution to the community. I'm a daily user of both and so thankful for the talent, ingenuity and effort that have gone into them. How Microsoft have managed the acquisition of GitHub, giving them autonomy and infrastructure support - so far, it's been all around positive. Now with NPM under their wings, the centralization does worry me somewhat. I hope there are conscientious decision-makers who will guide the project for the good of community and ecosystem.

debt 7y ago

Thank god. NPM is so crappy it desperately needs institutional support.

nathcd 7y ago

<tangent> Sometimes I wonder what the business world (and the internet) would be like if mergers and acquisitions weren't allowed. Like, if businesses had to be sustainable or they'd just die, rather than capturing a whole market while eating VC money, maybe we'd all be better off? All of the really embarrassing stuff coming out of SV would just go away? Just Pinboards and Sourcehuts and Mastodons ruling the web? I'm capitalistically illiterate, so somebody please tell me why this thought is stupid.

cortesoft 7y ago
What would happen to all the tech, equipment, and employees after the company goes out of business? We have to burn it? If we did that, it would be a crazy waste of resources. The alternative is to let another company buy the stuff... and if a company buys the failed company's tech, equipment, and hires their staff... that is basically the same as buying the company.
- nathcd 7y ago
  I mean, what would normally happen is employees look for new jobs, equipment is sold, and tech is thrown away (or open sourced in rare cases). Doesn't this already happen all the time?
  - cortesoft 7y ago
    It happens when no one wants the tech... but if it has value, it will be sold at liquidation time.

ginko 7y ago

Am I the only one surprized that there's an npm Inc. to be acquired? Why is there a for-profit corporation behind every open source project these days?

cfv 7y ago

Microsoft does have a much better track record in terms of keeping their products alive than other Way Way Large companies that could have made this acquisition, and for that I'm pretty glad. That said, and just in case their notoriously warlike legal team manages to fumble this somehow, I'd like to take the opportunity to remind every other frontender that Verdaccio (https://verdaccio.org/ https://verdaccio.org/) exists, is easy to implement, and relatively low maintenance.

TAForObvReasons 7y ago

NPM's blog post: https://blog.npmjs.org/post/612764866888007680/next-phase-montage https://blog.npmjs.org/post/612764866888007680/next-phase-mo...

ezekg 7y ago

Sorry, but npm burned me too many times. It is (was?) the worst package manager I've ever used. Not a fan of npm the company either. I'm sticking with yarn.

joshiefishbein 7y ago
Yarn is majorly only a CLI. It still uses NPM as the source for most packages. The product Github is probably most interested in is NPM as a repository for packages, not its CLI.

cjamesd 7y ago

Most important question: Will you still be able to see user-submitted phrases explaining the npm acronym? (See upper left-hand corner of https://www.npmjs.com/ https://www.npmjs.com/)

ethomson 7y ago
Yes, I love those. We'll keep those around for sure.
kyle-rb 7y ago
Damn, someone just beat me to "Now Part of Microsoft" https://github.com/npm/npm-expansions/pull/2936 https://github.com/npm/npm-expansions/pull/2936

mythz 7y ago

Just like GitHub this is a cloud play to make Azure more appealing by meeting developers where they're at, increase dev mindshare/reach, hosting their packages, CI Scripts/Actions then making it seamless to deploy to Azure. Smart, have no idea where AWS or GCP's control team are at when these strategic plays are going down.

Jaxkr 7y ago
I honestly think that Google cloud platform will be shut down within a couple years. It seems like it’s losing the war very badly.
- IceWreck 7y ago
  I am honestly amazed that there is no official way to install Fedora or Fedora CoreOS on GCP. There are no images even on the GCP marketplace. Stuff like this is what irritates me. Even small vps providers have this.

pavlov 7y ago

Heh, I called this 10 months ago: https://news.ycombinator.com/item?id=19838122 https://news.ycombinator.com/item?id=19838122 Somebody replied "Microsoft won't acquire npm for sure."

bbrree66 7y ago
Wow, congrats! You are amazing! I can't believe someone disagreed with your prediction.
RuleOfBirds 7y ago
Neat contribution! You guessed one thing, someone else guessed another, but they were wrong, and you were right! Yay on @pavlov. Boo on them.
- pavlov 7y ago
  A special day. The stock market is down 388% and 142% of people are predicted to die, but I got Internet karma points for guessing something right and that's what really counts.
russellbeattie 7y ago
I used to be excited when I made predictions like that. Then I realized that my correct predictions, plus $4.15, would only get me a Venti Latte at Starbucks.
deleted 7y ago
[deleted]

Jaxkr 7y ago

This is pretty great. NPM was struggling to monetize and is a critical part of the JavaScript ecosystem.

rtsao 7y ago

I hope this doesn't alter the current GitHub npm package registry policy where all packages must be published under a scope corresponding to name of the owning GitHub user/org. The resulting increased transparency and clarity of ownership will be great for the JS ecosystem. The existing npm ownership model is markedly less clear and has led to several problems, including the transfer of package publishing rights to bad actors without anyone being aware. On the whole, npm accounts and orgs were always just an unnecessary abstraction that obscured the actual provenance of software, of which GitHub is the de facto source.

toastal 7y ago
Does this mean using alternatives (GitLab, et. al) is not an option? The worst option has been Elm's system where the whole package system requires you to not only use GitHub, but when GitHub in down (which isn't uncommon unfortunately) packages that weren't cached locally were inaccessible with no mirroring options.
clarkbw 7y ago
Yes thank you! We believe namespaces are a good thing and will continue to promote it as best practice. Hopefully we can integrate repository information to packages meta data such that you could be aware of a change of ownership even for a globally namespaced package.
ocdtrekkie 7y ago
I think this is the big reason I'm excited about NPM joining GitHub. I don't trust NPM (I'm not fond of package repos in general), but tying packages closely to their GitHub source offers significantly more verification potential that a package is in fact comprised of the source code for it, and that it hasn't recently turned hostile.

bjt2n3904 7y ago

You know, my initial reaction was... oh no, the toxic people who run NPM and Node.js[1][2] are going to infect GitHub. But then I read that other front page article about the guy that got mysteriously "flagged", and the invasive questions he was asked. Maybe Github is already too far gone. Maybe it should be... please, bundle all the toxic people together in one spot, and let it all come crashing to the ground. I've had serious reservations about using Node.js in a product I've been tasked to work on, for the reasons I listed below. It'd be great if they just... ceased to exist. 1 - left-pad incedent 2 - The Ayo fork drama

rattray 7y ago
Wishing ill on others or their projects ("it'd be great if they ceased to exist") does not reduce toxicity.

waydowntogo 7y ago

RIP NPM

jxub 7y ago

NPM is joining GitHub, GitHub joins Microsoft, Microsoft joins... ;)

thawkins 7y ago

Time to get behind Deno https://en.m.wikipedia.org/wiki/Deno_(software) https://en.m.wikipedia.org/wiki/Deno_(software) Built by the node team to replace node.

ilaksh 7y ago

For how much money I wonder.

ryanmarsh 7y ago

How much did Microsoft pay? What did the founders take away? Most people don’t know, in these open source acquisitions by for profits there’s money involved and “founders” get an exit. Not always clear To the public who those are or what they took home from a mostly volunteer effort.

lioeters 7y ago
I too was curious about how much the acquisition cost. According to TechCrunch: > GitHub, the developer repository owned by Microsoft, made a little deal of its own this morning when it bought JavaScript packaging vendor npm for an undisclosed amount. https://techcrunch.com/2020/03/16/github-nabs-javascript-packaging-vendor-npm/ https://techcrunch.com/2020/03/16/github-nabs-javascript-pac...

29athrowaway 7y ago

Hopefully they don't drop Linux support like they did with Skype, Minecraft, Xamarin[1], Corel Office and a long list of products. Their strategy from my perspective is to ensure Linux does not become a competitor for their desktop OS. 1: it never had Linux support.

chungy 7y ago
Skype returned with a Linux client, and Minecraft never dropped Linux support at all.
- 29athrowaway 7y ago
  Minecraft for Linux does not have the same features.
  - chungy 7y ago
    What features are you talking about? It literally uses the same launcher and same jar files. It's exactly the same game.

no_wizard 7y ago

I see this as a straightforward play, simply put, I think (to summarize, perhaps a little to broadly) - They want to sell Azure Services - Most (if not all) NPM packages already live on github - NPM has a business revolving around package management, including private npm instances and increasingly around node/package security - This being primarily a business that will sell to has-money businesses (e.g., medium to large businesses, Fortune 500 corporations etc) So, given all of the above, it makes sense to have a vertical selling into one of the fastest growing package management ecosystems where you can be the "full stack" provider of developer/enterprise tools. I don't think its anything beyond this, personally. I expect to see a lot of pushes to integrate with Azure Pipelines, cloud deployment etc. centered around this. I wonder if they'll buy Passenger[0] next, its a popular (in my experience) to deploy nodejs applications. [0]https://www.phusionpassenger.com/library/ https://www.phusionpassenger.com/library/

inputError 7y ago

THANK FUCKING GOD

nojvek 7y ago

Github announced the Github packages feature a while back, but without npm it didn't quite make sense. Acquiring npm means github not only hosts source code, but packages as well. With Github Actions, they want to be the one stop shop for code lifecycle and be at the forefront of javascript ecosystem. If developers love Github, they love the cloud. Microsoft is betting big on the cloud, they lost the Mobile war but they definitely want to be the developer and cloud darlings.

worik 7y ago

Perhaps they will do the right thing and shut it down

flanbiscuit 7y ago

I wonder if more people will look into adopting Deno[1], the new node alternative by one of the creators of Node. It does not use NPM, you pull in packages Go-style (via URLs[2]). It's supposed to be more secure because you have to explicitly give it access to anything (i.e. network, file system, etc). [1] https://deno.land/ https://deno.land/ [2] example import in Deno: import { serve } from "https://deno.land/std@v0.36.0/http/server.ts"; Previous HN about Deno: https://news.ycombinator.com/item?id=22102656 https://news.ycombinator.com/item?id=22102656

wwweston 7y ago
The thought that's going into Deno about permissions and upstream package issues have me considering it where I've generally rejected node.js for anything serious (also recognizing that it's probably early for production use).
threatofrain 7y ago
Is deno debugging there yet?
ledgerdev 7y ago
Node+NPM isn't going anywhere, but Deno sure seems like the server based runtime of the future.
miohtama 7y ago
Deno truly seems interesting. Especially native TypeScript ability. Who is backing the project in this point?

breatheoften 7y ago

(Wishful thinking ...) Does this mean the next release of npm will be yarn v2 and that typescript will implement support for the pnp spec so we can converge the javascript packaging space to a sane place?

Vinnl 7y ago
There already is a Yarn v2: https://dev.to/arcanis/introducing-yarn-2-4eh1 https://dev.to/arcanis/introducing-yarn-2-4eh1
- breatheoften 7y ago
  Does typescript support pnp somehow now? (That's actually the thing I'm wanting ...). npm's cli going away was an attempted tease (in bad-taste i think)

skrebbel 7y ago

Assuming this was an acceptable exit: I'm impressed that NPM pulled this off. They were basically doing the "no revenue model to speak of, hope we'll get acquired by a bigco" startup play that was starting to go out of vogue already when they were founded. I wonder to what extent they've had influence over their own success at all though. Basically they had to hope that JS stayed popular (it did), that Node stayed relevant (it did) and that the entire JS ecosystem would move over to NPM (it did, but I'd say rather despite NPM than because of it) (I mean, otherwise Yarn wouldn't even exist, right?). So basically their bet was: - Turn NPM into a startup - Keep the lights on I bet I'm missing all kinds of key behind-the-scenes stuff, but still, I don't know many startups that manange to successfully exit by "just" keeping the lights on. In a weird cringey way, it's motivating.

daveisfera 7y ago
Neither side is announcing a price and NPM has been struggling financially for a while, so the likelihood that it was a "good exit" is low.
zomglings 7y ago
Not sure how good an exit it was. Crunchbase says they have fewer than 50 employees [0], so I'm guessing the first 10 people did pretty well but that the rest got what amounts to a nice bonus. Keeping the lights on long enough makes this kind of exit more likely. Paul Graham has a good article about this: http://www.paulgraham.com/die.html http://www.paulgraham.com/die.html NPM did better than "just" keeping the lights on, though. They even held Yarn at bay by adopting its best features very quickly. [0] https://www.crunchbase.com/organization/npm https://www.crunchbase.com/organization/npm
tdumitrescu 7y ago
Here's what isaacs writes in the NPM blog post (https://blog.npmjs.org/post/612764866888007680/next-phase-montage https://blog.npmjs.org/post/612764866888007680/next-phase-mo...). It doesn't seem like anyone on the NPM team did great financially from this: "I have a set of goals that I wrote down back then, and have shared openly with the team. ... 3. Get a big enough exit that I can quit my job and see what comes out of me a second time. 4. Share the rewards equitably with the people who got npm to where it is. ... On (3), well, I’m still working a jobby job, but I always knew that was a long shot, and “make npm a better package manager” is a job I enjoy. And as for (4), I’m proud of the deals that we’ve been able to negotiate for the team. It’s not a kajillion billion dollar 10x startup cinderella story, and we’ve taken our hits, but in the end we’ve done right by our community, team, and careers, and I’m extremely proud of what we’ve achieved."

collyw 7y ago

I hope it's not going to do a left-pad fiasco on everything in github.

mekoka 7y ago

Next in line is Canonical.

mtkd 7y ago

Mid Oct 2009 -- Github ceased gems.github.com to focus on source control

okareaman 7y ago

I'd like to see Microsoft bring Ryan Dahl (original author of node) back in the fold by sponsoring/buying Deno with TypeScript. It's a good fit.

hn_throwaway_99 7y ago

Current me loves this, and I love all the GitHub tools they've added recently. Future "5-10 years down the road" me knows this will suck, ending up where all concentrated monopolies end up...

talawahtech 7y ago

Ok now Microsoft just needs to acquire what remains of Docker and their Developers, Developers, Developers, Developers collection will be complete.

throwaway78359 7y ago

Microsoftie here — throwaway for obvious reasons. Microsoft doesn’t do everything right but the GitHub acquisition has honestly gone better than I ever expected. Rather than forcing GitHub to adopt Microsoft centric policies, Microsoft has adopted more GitHub stuff, especially from a product POV. GitHub still runs as a separate company (different logins and health care and hiring systems) with its own policies and point of view. The reality is npm was in a bad place and in a land of not good options, this strikes me as the best possibility. I’d rather have GitHub control this and be able to give the resources to npm than a company like Oracle or Amazon or even Google or Facebook to own it. In a perfect world, some independent entity could fund npm out of gratitude but at the same time, consider how poorly npm as a company was run for YEARS and the general lack of direction. So yeah, I’m cautiously optimistic this won’t be fucked up by GitHub — but I understand the concern. As for those worried about Microsoft embracing, extending, and extinguishing. Lol. Even if that was the goal (and I truly don’t think that’s the ethos at all any more), Microsoft is laughably incompetent at achieving that sort of strategy. Google and Amazon have the EEE under lock right now (Facebook too — let’s be glad Zuck didn’t buy this after we saw what happened to yarn), but Microsoft can’t even put coherent dev strategy outside of .NET on Azure.

skrebbel 7y ago
> after we saw what happened to yarn I missed something, what happened to Yarn?
- purplerabbit 7y ago
  Second this. It still seems to be working fine... (actually, better than npm last I checked)
- pkilgore 7y ago
  The maintainer released Yarn 2. Yarn 2 is pretty foundationaly different than Yarn 1, and can and does break a lot of products/projects if used. Some folks are not happy about it, although Yarn 1 will probably continue to be maintained by the community for a while. This seems to be pretty fair about the whole thing: https://shift.infinite.red/yarn-1-vs-yarn-2-vs-npm-a69ccf0229cd https://shift.infinite.red/yarn-1-vs-yarn-2-vs-npm-a69ccf022...

dzonga 7y ago

in as much as I love Github, putting our eggs in one basket as developers is gonna burn us soon or later. we need redundancies in the system, that if one thing goes down, the world can go on as normal. now we're centralizing github as a single failure point. we've already seen the the panic outages of Github or S3 cause.

Phenix88be 7y ago

I'm always worried when thing like this happen : Critical open source entities are bought by private company. I understand the need for money and sustainability these entities need, but it's really a shame that the open source community doesn't "own" themselves.

abledon 7y ago

what does this mean for yarn?

ryanmccullagh 7y ago

Microsoft owns so may day-to-day tools and platforms. LinkedIn, GitHub, NPM.

hateful 7y ago

They could probably save tons just by deduping the npm and github homepages of every package!

Kenji 7y ago

You naive idiots. You just sold the keys to the JavaScript kingdom to Microsoft.

thulecitizen 7y ago

Yay more centralization! What could possible go wrong with critical components being hosted by one big corporation?

craftyguy 7y ago

title should be "microsoft acquires NPM"

znpy 7y ago

this should really be titled "npm is joining Microsoft"

thunderbong 7y ago

Ok, everyone seems to be beating up on Microsoft per the top comment here. I have a counter point - Does anyone ever think what would happen if Microsoft were to disappear tomorrow? How would you get your drivers license? How would you process your mortgage? How would you go about buying tickets for anything? How would you get your groceries and food? Are we expecting everyone to run Linux? Or shall we say, Ubuntu? Or was it Mint? Can we decide on a specific desktop OS? Can we? Can we pick up a USB wifi dongle or connect a printer and expect it to work? Are you frikkin kidding me? We'd be running around like chickens with their heads cut off. Get over it, all of you. Frikkin grow up. We've had the thirty years since Linux came on the scene. And what have we done? You'll say - "we've got the server market". Sure. And what is that? Ubuntu, right? Give me a break. If it wasn't for Mark Shuttleworth, even that wouldn't have been there. We want to be kids. We want to play with our toys in our corner of the room throughout our lives and we want others to clothe and feed us for free. That's what we want. We want to share, but don't want others to make money off it. And what happens? A big corporate comes around giving everything away for free, and we all grab it with both our hands. And 15 years later, we cry that the corporate has gone evil. We keep complaining about Microsoft on Hacker News, typing on Apples and iPhones and Androids. Are you all delusional? Are you all blind? There is NOTHING free in this world, including lunches. People pay for things that will work together seamlessly, that takes the least effort to work with. Why? Because software, programs, operating systems are not the end of the world, life is. There are more important things in life that tabs or spaces, or carriage returns and line feeds. And the only way that can happen, when someone says I'll give $X for Y and you give him Y, rather than twiddling around with Z. I've had battles with Microsoft by way of IE. I've also battled with Linux. Major battles. But the battles I've had with Microsoft, I got paid for. The battles with Linux? Well, maybe I got music playing on my laptop. Only on mine, mind you! I think it's time we admitted to ourselves, that we can't decide on anything collectively. I think it's time we stopped being cranky, demanding, tantrum throwing children. We'll all die soon and everyone will be paying for software as a service and we'll all be old farts talking about the good old days, when we could download a program, modify it and run it only on our system. I'm tired of all your hangups. Holding on to decade old grudges. Dreaming about the glorious future of software that just might have existed if everyone had just the same idea as you. Grow up, open your eyes, get a life. Stop being so self-centered and churlish. Stop trying to see flaws everywhere except yourself. Stop trying to complain about open source everywhere and see that all kinds of software need to exist. Go out. Do good for someone. Get paid for it. Come back home. Enjoy dinner with your family. Get a good night's sleep.

aikah 7y ago

Who predicted it 5 month ago? hmm? https://news.ycombinator.com/item?id=21031266 https://news.ycombinator.com/item?id=21031266 I also predicted a few more controversial things but if you think it terms of ecosystem and cloud market strategy, then it makes perfect sense.

z3t4 7y ago

Was gonna write about all the bad stuff that can happen, but don't want to give any ideas. Instead I give advice; embrace and empower, rather then extend and extinguish.

rambojazz 7y ago

What are they buying, precisely? Open source software?

goofballlogic 7y ago

A sad day I think. I wish more independent ecosystems were evolving, instead of consolidating.

papito 7y ago

You are all Microsoft developers now :)

rodgerd 7y ago

Microsoft have been making their code analysis tools available in GitHub post-aquisition; doing the same for npm could really help improve the risks JS programmers face when pulling in libraries from npm.

mekster 7y ago

What I'd hope : Somehow make packages more secure than hoping that nothing is tainted in the dependency. I think this is the biggest issue of volunteer package repo. What I'd not hope : MS changes strategy with change of people etc and npm and GitHub rot.

justlexi93 7y ago

Happy to hear this. Microsoft has been doing a great job with Github IMO.

hrjd 7y ago

At anytime in the future, the product might have licensing gotchas to run elsewhere than Microsoft cloud products. This is already happening with Windows and SQL server licensing. This will happen sooner or later.

pmwatson 7y ago

After how Microsoft have handled GitHub I'm not worried. However even a non-.NET web-developer now could be using quite a bit of Microsoft owned tech; VSCode GitHub npm Azure

lucaspottersky 7y ago

WHAT. A. JOKE.

larodi 7y ago

i didn't so far realized that npm was a company, and not a tool . wow.

classified 7y ago

So essentially, Microsoft has bought npm. Smart move. Seeing that node.js builds on top of Googleware, this is not the worst that could have happened.

1337shadow 7y ago

Any npm alternative yet ?