16 ms·

This seems like a good outcome overall. NPM being such an important pillar in the software supply chain while having an unviable business model and largely bein

This seems like a good outcome overall. NPM being such an important pillar in the software supply chain while having an unviable business model and largely being funded by VC money was never a good position to be in. There are problems with more of the software ecosystem consolidating with a single entity but it still feels like an improvement.

hinkley 7y ago
It does have a bit of a 'value add' feel to it. But, you know, we've had decades of companies whose 'business model' is just their exit strategy...
cycloptic 7y ago
It was already consolidated. The vast majority of public npm packages are already hosted on Github. The dependency on them has been there since the beginning.
- yjftsjthsd-h 7y ago
  I would expect that moving git repos is easier than replacing NPM?
  - cycloptic 7y ago
    It is, but who is doing that? The users of NPM all are choosing to stay on Github.
- davnicwil 7y ago
  Yes, indeed - and the dependency is literally right there on the technical level. For years, you've been able to specify a version of a package as a github repo's branch HEAD. npm i some-package username/repo#branchName
  - ChristianBundy 7y ago
    Bonus points: npm install username/repo#semver:^1.2.3 The big problem is that lots of Node.js modules don't push their tags, so there are issues on lots of repos begging maintainers to push their Git tags so that we don't have to use the npm registry. JavaScript is an interpreted language -- as long as you're only downloading source code from the registry there's really no reason to use a registry instead of the plain old Git repository.
    - sneak 7y ago
      There is a build/transpilation step.
    - lioeters 7y ago
      A common issue I've had with using Git repos directly as Node.js modules, is that many projects are transpiled/built before publishing to NPM. Depending on specifics of that build process, it may not work out of the box (or at all) from a node_modules folder. With NPM acquired by GitHub, I can imagine them "filling in some steps" by leveraging the fairly new Actions feature, so that repos can provide built artifacts, the same ones as published on NPM. The deeper integration will be an interesting development to watch.
      - oefrha 7y ago
        Repos have been able to provide artifacts since forever ago; they just don’t sit in the tree. While you can commit from an action, I’m not sure that’s a great idea.
        lioeters 7y ago
        You're right, artifacts in GitHub repos have been around a long time. I suppose what I was missing was a way to point to a specific built artifact (like a tar.gz from a release) as a dependency, from package.json. As far as I know, it's not possible yet with npm. I can imagine that will be covered somehow with deeper integration of GitHub and the NPM package repository.
deleted 7y ago
[deleted]
grumple 7y ago
Exactly, especially given the instability over at NPM. Hopefully MS / Github can be a stabilizing influence both financially and culturally.
sneak 7y ago
I do not consider the largest distributor of proprietary, closed-source spyware (Windows) owning the fastest growing open source package manager to be a good outcome, personally.
- Supermancho 7y ago
  You aren't the only one. Most users are too young to understand how predatory Microsoft has always been. Can't wait for the "npm won't publish my package because it circumvents something in Windows" or whatever. Give it time.
  - bdcravens 7y ago
    I am old enough (42) to remember those days, but honestly I don't feel that threatened by them. I remember their EEE days, and for a long time I haven't seen much of the same behavior.
    - bromuro 7y ago
      Same here (40). I was with Ballmer singing “developer developer developer”... i think his legacy is not that bad. The company was not ready to grasp the idea of open source at these times, but the principle holds.
  - allover 7y ago
    Tbf Microsoft have won back a lot of good faith with developers due to projects like VS Code and TypeScript, even for those of us who remember their past. And we're yet to hear of any negative impact of their Github acquisition (afaik - correct me if wrong).
    - judge2020 7y ago
      Before someone else comes along and writes a monologue, the biggest downside might be how it handled (didn't break) its contract with ICE[0]. If the acquisition didn't happen, old GitHub might've dropped the contract immediately upon enough employees speaking about it. 0: https://news.ycombinator.com/item?id=21412600 https://news.ycombinator.com/item?id=21412600
Twirrim 7y ago
I'm not sure I like the continued consolidation of all things tech around just a few large companies. That's generally not a good place to be.
- Barrin92 7y ago
  given the significant returns to scale in the tech industry this is a pretty natural development and it happens in most tech sectors over time as monopolistic competition generally outperforms the 'bazaar' economy. 'small business' is only the equilibrium in sectors that can't increase aggregate output by growing or capital investment like say, the restaurant industry.
mbesto 7y ago
> NPM being such an important pillar in the software supply chain while having an unviable business model and largely being funded by VC money was never a good position to be in. Why does NPM need to be funded as a commercial entity at all? What other open source library has a private company running its package manager? This one still boggles my mind.
- fierarul 7y ago
  Maven Central is no hosted by Apache for example.
- timrod 7y ago
  For programming languages, there are several examples of commercially run package managers: - the Java/Kotlin/Scala ecosystem is based around maven central, which is run by Sonatype, Inc. - Go modules are hosted by Google. Previously, most libraries were hosted on Github - Rust's crate index is on Github - The Docker/Moby registry is run by Docker, Inc. (though that might be a stretch for "package manager" :))
  - zeeboo 7y ago
    Technically the Go module _proxy_ is hosted by Google. Even if the proxy went away, you'd still be able to get access to all of the packages as they're still hosted elsewhere. It just wouldn't be as fast.
  - bad_user 7y ago
    Maven Central has mirrors and alternatives and you can trivially host your own repository, all you'd need is a plain web server serving a bunch of static files. Some libraries aren't hosted on Maven Central actually, so it's not uncommon to see instructions for adding extra resolvers to your build config. The Java ecosystem isn't as dependent on Maven Central as the JavaScript ecosystem is on npmjs.com
    - brunoborges 7y ago
      Almost every library out there is on Maven Central. Even Oracle JDBC drivers are now (finally) on Maven Central. If MC goes away as it exists today, the Java Ecosystem will take a huge hit as almost every open source project would stop building in CICD environments from the get-go.
dcposch 7y ago
I'd really love to teleport some forum nerd from just six years ago to the present. - Microsoft is a leading sponsor of open source? - In fact, .NET is open source now and runs on Linux? - Microsoft bought Github, then NPM... and the community is celebrating both of those things?? - The guy from the apprentice is what?
- Conan_Kudo 7y ago
  > Microsoft bought Github, then NPM... and the community is celebrating both of those things?? I don't think you could honestly say the community celebrated both of those things.

hinkley 7y ago

It does have a bit of a 'value add' feel to it. But, you know, we've had decades of companies whose 'business model' is just their exit strategy...

cycloptic 7y ago

It was already consolidated. The vast majority of public npm packages are already hosted on Github. The dependency on them has been there since the beginning.

yjftsjthsd-h 7y ago
I would expect that moving git repos is easier than replacing NPM?
- cycloptic 7y ago
  It is, but who is doing that? The users of NPM all are choosing to stay on Github.
davnicwil 7y ago
Yes, indeed - and the dependency is literally right there on the technical level. For years, you've been able to specify a version of a package as a github repo's branch HEAD. npm i some-package username/repo#branchName
- ChristianBundy 7y ago
  Bonus points: npm install username/repo#semver:^1.2.3 The big problem is that lots of Node.js modules don't push their tags, so there are issues on lots of repos begging maintainers to push their Git tags so that we don't have to use the npm registry. JavaScript is an interpreted language -- as long as you're only downloading source code from the registry there's really no reason to use a registry instead of the plain old Git repository.
  - sneak 7y ago
    There is a build/transpilation step.
  - lioeters 7y ago
    A common issue I've had with using Git repos directly as Node.js modules, is that many projects are transpiled/built before publishing to NPM. Depending on specifics of that build process, it may not work out of the box (or at all) from a node_modules folder. With NPM acquired by GitHub, I can imagine them "filling in some steps" by leveraging the fairly new Actions feature, so that repos can provide built artifacts, the same ones as published on NPM. The deeper integration will be an interesting development to watch.
    - oefrha 7y ago
      Repos have been able to provide artifacts since forever ago; they just don’t sit in the tree. While you can commit from an action, I’m not sure that’s a great idea.
      - lioeters 7y ago
        You're right, artifacts in GitHub repos have been around a long time. I suppose what I was missing was a way to point to a specific built artifact (like a tar.gz from a release) as a dependency, from package.json. As far as I know, it's not possible yet with npm. I can imagine that will be covered somehow with deeper integration of GitHub and the NPM package repository.

deleted 7y ago

[deleted]

grumple 7y ago

Exactly, especially given the instability over at NPM. Hopefully MS / Github can be a stabilizing influence both financially and culturally.

sneak 7y ago

I do not consider the largest distributor of proprietary, closed-source spyware (Windows) owning the fastest growing open source package manager to be a good outcome, personally.

Supermancho 7y ago
You aren't the only one. Most users are too young to understand how predatory Microsoft has always been. Can't wait for the "npm won't publish my package because it circumvents something in Windows" or whatever. Give it time.
- bdcravens 7y ago
  I am old enough (42) to remember those days, but honestly I don't feel that threatened by them. I remember their EEE days, and for a long time I haven't seen much of the same behavior.
  - bromuro 7y ago
    Same here (40). I was with Ballmer singing “developer developer developer”... i think his legacy is not that bad. The company was not ready to grasp the idea of open source at these times, but the principle holds.
- allover 7y ago
  Tbf Microsoft have won back a lot of good faith with developers due to projects like VS Code and TypeScript, even for those of us who remember their past. And we're yet to hear of any negative impact of their Github acquisition (afaik - correct me if wrong).
  - judge2020 7y ago
    Before someone else comes along and writes a monologue, the biggest downside might be how it handled (didn't break) its contract with ICE[0]. If the acquisition didn't happen, old GitHub might've dropped the contract immediately upon enough employees speaking about it. 0: https://news.ycombinator.com/item?id=21412600 https://news.ycombinator.com/item?id=21412600

Twirrim 7y ago

I'm not sure I like the continued consolidation of all things tech around just a few large companies. That's generally not a good place to be.

Barrin92 7y ago
given the significant returns to scale in the tech industry this is a pretty natural development and it happens in most tech sectors over time as monopolistic competition generally outperforms the 'bazaar' economy. 'small business' is only the equilibrium in sectors that can't increase aggregate output by growing or capital investment like say, the restaurant industry.

mbesto 7y ago

> NPM being such an important pillar in the software supply chain while having an unviable business model and largely being funded by VC money was never a good position to be in. Why does NPM need to be funded as a commercial entity at all? What other open source library has a private company running its package manager? This one still boggles my mind.

fierarul 7y ago
Maven Central is no hosted by Apache for example.
timrod 7y ago
For programming languages, there are several examples of commercially run package managers: - the Java/Kotlin/Scala ecosystem is based around maven central, which is run by Sonatype, Inc. - Go modules are hosted by Google. Previously, most libraries were hosted on Github - Rust's crate index is on Github - The Docker/Moby registry is run by Docker, Inc. (though that might be a stretch for "package manager" :))
- zeeboo 7y ago
  Technically the Go module _proxy_ is hosted by Google. Even if the proxy went away, you'd still be able to get access to all of the packages as they're still hosted elsewhere. It just wouldn't be as fast.
- bad_user 7y ago
  Maven Central has mirrors and alternatives and you can trivially host your own repository, all you'd need is a plain web server serving a bunch of static files. Some libraries aren't hosted on Maven Central actually, so it's not uncommon to see instructions for adding extra resolvers to your build config. The Java ecosystem isn't as dependent on Maven Central as the JavaScript ecosystem is on npmjs.com
  - brunoborges 7y ago
    Almost every library out there is on Maven Central. Even Oracle JDBC drivers are now (finally) on Maven Central. If MC goes away as it exists today, the Java Ecosystem will take a huge hit as almost every open source project would stop building in CICD environments from the get-go.

dcposch 7y ago

I'd really love to teleport some forum nerd from just six years ago to the present. - Microsoft is a leading sponsor of open source? - In fact, .NET is open source now and runs on Linux? - Microsoft bought Github, then NPM... and the community is celebrating both of those things?? - The guy from the apprentice is what?

Conan_Kudo 7y ago
> Microsoft bought Github, then NPM... and the community is celebrating both of those things?? I don't think you could honestly say the community celebrated both of those things.