9 ms·

It depends on what the alternative is. When NPM starts running out of money to run the service what would happen? More VC, but only to a point and the firms wou

It depends on what the alternative is. When NPM starts running out of money to run the service what would happen? More VC, but only to a point and the firms would be increasingly be influencing NPM to make money by any means(probably not good for anyone but the firms). Alternatively a cash strapped NPM fails to invest in security and availability of the service leading to widespread outages or worse a large scale supply chain attack facilitated via the registry.

mulmen 7y ago
This is sad to read. Why does every project have to be profitable? If NPM is useful users (companies and people) can invest time or cash to support the operations and continued development. This foundation model has been successful across open source and prevents one company from changing the direction of a project to fit their own needs at the expense of everyone else. I think this was critical to the continued growth of open source software over the last two decades. If this trend of selling out to massive corporations continues it will be a major step backwards.
- K0nserv 7y ago
  To be clear that's not what I am arguing here, I agree that package registries should, ideally, be owned and supported by the community. However NPM already had fairly significnat VC investment and as such any transition to a community supported model would be challenging. The acquisition can be a good outcome for the current situation without it being the ideal state of things.
- nine_k 7y ago
  Profitable of not, they should not run out of money. Would yo prefer npm infrastructure to be maintained and developed by the lowest-paid programmers they could hire?
  - teknopaul 7y ago
    Imhi Npm is two things a cli tool, and a central repo that tries to be the one and only js repo: to make money from that position. Their infra costs them money only because that was their angle for selling out. Linux repos take the alternative approach to try to get as many mirrors as possible so it can remain free. Microsoft did not buy npm to help it become free. Believe. They bought it because they rekon they can make buck out of it. That buck comes from somewhere. Nodejs going to the Linux foundation was good news. Microsoft buying Npm is bad news.
mbesto 7y ago
> It depends on what the alternative is. Ruby Gems, PHP composer, PIP, etc. would all like a word with you.... https://rubygems.org/pages/sponsors https://rubygems.org/pages/sponsors https://www.python.org/psf/ https://www.python.org/psf/
- K0nserv 7y ago
  That's a path but NPM already being a company with signficant VC investment would a transition to such a model workout with the existing stakeholders? Also NPM is quite a bit bigger than both the Ruby and Python library spaces.
  - nerdwaller 7y ago
    > Also NPM is quite a bit bigger than both the Ruby and Python library spaces. I don’t know, so I have to ask, what’s the metric here?
    - sah2ed 7y ago
      Perhaps because Node code bases when deployed cause the package manager (npm) to consume more bandwidth in general than comparable Ruby or Python code bases due to higher dependence on third-party packages? As at Oct. 2018, the top 12 npm packages [1] were already doing more than 0.5 billion downloads a month. Granted, popularity has waned for a few of those top packages due to deprecation or new language features, for instance. EDIT: NPM’s announcement about the acquisition [2] provides up-to-date numbers: “Today, npm serves over 1.3 million packages to roughly 12 million developers, who download these things 75 billion times a month ...” 1: https://news.ycombinator.com/item?id=18343604 https://news.ycombinator.com/item?id=18343604 2: http://blog.npmjs.org/post/612764866888007680/next-phase-montage http://blog.npmjs.org/post/612764866888007680/next-phase-mon...
      - nerdwaller 7y ago
        You're probably right with all the one-off and fairly small dependencies in the npm ecosystem. Seeing those numbers would be pretty neat to compare side-by-side.
wongarsu 7y ago
Why would NPM run out of money? NPM is the primary vendor for worry-free distribution and management of private JavaScript packages for $7/month/user. In a time where bandwidth is basically free (outside AWS/Azure/GCP) that should surely pay for server costs and a handful of developers. It probably isn't going to 20x VC money, but it sounds like it would be profitable to run as a business.
- teknopaul 7y ago
  Agreed. It was profitable before, (no indication they sold at a loss), it will probably be profitable after for MS. "2fa" sounds bad. That is clearly marketing bs for linking your npm account to a MS account with more personal info attached. Ease of publishing will be the first thing to go. Then the fun will disappear with MS as owner, like when Oracle bought Java. Happy to be a rustacean.
  - oaiey 7y ago
    Regards 2FA/Login: Except that Microsoft has not done this with GitHub. And NPM is joining GitHub not Microsoft. You will see non login vanishing in favor of GitHub Login for sure. And the second factor, see what GitHub offers. For me that is currently a OTP generator
    - teknopaul 7y ago
      Gihub already had a masssive social graph. They know who you are in terms of who you work for and who your CTO is. Npm does not know that about me. It has no sales channel.
      - oaiey 7y ago
        GitHub is owned by the same entity that owns LinkedIn. Microsoft has really no problems cross linking persons. They can also easily link the source code between the systems etc (if they want).
        7y ago
sneak 7y ago
The alternative is that the entire source control system (GitHub) and the entire artifact registry (npm) are run by a giant multinational military defense contractor with close and longstanding ties to the US military. Did we forget so soon that the Snowden slides are PowerPoint? I'm not sure that's an improvement in any way whatsoever.
- oaiey 7y ago
  No US company is better in that regard. I prefer one with an army of lawyers. Damn, should have gone to Oracle. That is a joke. A joke!!!
- crummy 7y ago
  > Did we forget so soon that the Snowden slides are PowerPoint? what does that mean? That Microsoft works for the NSA or something?
  - sneak 7y ago
    Microsoft does indeed work for and with the NSA. As an ASP they participate in the warrantless PRISM bulk collection program (they were the first!), and they also provide software and services (support) as a direct vendor.
- jki275 7y ago
  The military is a MS customer, just like nearly everyone else on the planet. Calling them a “defense contractor” is a very long stretch.
  - teknopaul 7y ago
    No its not.
    - jki275 7y ago
      Boeing is a defense contractor. Northrup is a defense contractor. MS? Not even a chance. What percent do you think of their business is actually government, beyond buying licenses just like nearly every other corporation on the planet.
AkshatM 7y ago
Change my mind: package management infrastructure run by government as a public service should be the ideal end outcome for everyone. Why I think this: private or volunteer models are unsustainable in the long run owing to funding uncertainties or conflicts of interest between stakeholders. Utilities that support the bulk of our technical infrastructure should be secured by public interests. Governments can keep things free. Common objections: - "Governments are inefficient". Depends on the area. The government tends to be inefficient in handling areas with direct consumer benefit, but less so in dealing with consortiums or private entities. Since private entities are the primary mainstream users of packages, I don't think government will be too slow on this front. - "Governments will be malicious". This I don't doubt, but the solution for that is building better trust mechanisms rather than keeping a practical solution at bay, and for software at least such trust mechanisms are tenable e.g. see the CNCF's Falcon project.
- teknopaul 7y ago
  I like Linux's decentralized approach. That would work for Npm. Npm has enough problems that its worth running your own mirror for business continuity. Microsoft are likely to make breaking changes immediatly.
  - halkcyon 7y ago
    > That would work for Npm. Npm has enough problems that its worth running your own mirror for business continuity. And risk-averse businesses do already.

mulmen 7y ago

This is sad to read. Why does every project have to be profitable? If NPM is useful users (companies and people) can invest time or cash to support the operations and continued development. This foundation model has been successful across open source and prevents one company from changing the direction of a project to fit their own needs at the expense of everyone else. I think this was critical to the continued growth of open source software over the last two decades. If this trend of selling out to massive corporations continues it will be a major step backwards.

K0nserv 7y ago
To be clear that's not what I am arguing here, I agree that package registries should, ideally, be owned and supported by the community. However NPM already had fairly significnat VC investment and as such any transition to a community supported model would be challenging. The acquisition can be a good outcome for the current situation without it being the ideal state of things.
nine_k 7y ago
Profitable of not, they should not run out of money. Would yo prefer npm infrastructure to be maintained and developed by the lowest-paid programmers they could hire?
- teknopaul 7y ago
  Imhi Npm is two things a cli tool, and a central repo that tries to be the one and only js repo: to make money from that position. Their infra costs them money only because that was their angle for selling out. Linux repos take the alternative approach to try to get as many mirrors as possible so it can remain free. Microsoft did not buy npm to help it become free. Believe. They bought it because they rekon they can make buck out of it. That buck comes from somewhere. Nodejs going to the Linux foundation was good news. Microsoft buying Npm is bad news.

mbesto 7y ago

> It depends on what the alternative is. Ruby Gems, PHP composer, PIP, etc. would all like a word with you.... https://rubygems.org/pages/sponsors https://rubygems.org/pages/sponsors https://www.python.org/psf/ https://www.python.org/psf/

K0nserv 7y ago
That's a path but NPM already being a company with signficant VC investment would a transition to such a model workout with the existing stakeholders? Also NPM is quite a bit bigger than both the Ruby and Python library spaces.
- nerdwaller 7y ago
  > Also NPM is quite a bit bigger than both the Ruby and Python library spaces. I don’t know, so I have to ask, what’s the metric here?
  - sah2ed 7y ago
    Perhaps because Node code bases when deployed cause the package manager (npm) to consume more bandwidth in general than comparable Ruby or Python code bases due to higher dependence on third-party packages? As at Oct. 2018, the top 12 npm packages [1] were already doing more than 0.5 billion downloads a month. Granted, popularity has waned for a few of those top packages due to deprecation or new language features, for instance. EDIT: NPM’s announcement about the acquisition [2] provides up-to-date numbers: “Today, npm serves over 1.3 million packages to roughly 12 million developers, who download these things 75 billion times a month ...” 1: https://news.ycombinator.com/item?id=18343604 https://news.ycombinator.com/item?id=18343604 2: http://blog.npmjs.org/post/612764866888007680/next-phase-montage http://blog.npmjs.org/post/612764866888007680/next-phase-mon...
    - nerdwaller 7y ago
      You're probably right with all the one-off and fairly small dependencies in the npm ecosystem. Seeing those numbers would be pretty neat to compare side-by-side.

wongarsu 7y ago

Why would NPM run out of money? NPM is the primary vendor for worry-free distribution and management of private JavaScript packages for $7/month/user. In a time where bandwidth is basically free (outside AWS/Azure/GCP) that should surely pay for server costs and a handful of developers. It probably isn't going to 20x VC money, but it sounds like it would be profitable to run as a business.

teknopaul 7y ago
Agreed. It was profitable before, (no indication they sold at a loss), it will probably be profitable after for MS. "2fa" sounds bad. That is clearly marketing bs for linking your npm account to a MS account with more personal info attached. Ease of publishing will be the first thing to go. Then the fun will disappear with MS as owner, like when Oracle bought Java. Happy to be a rustacean.
- oaiey 7y ago
  Regards 2FA/Login: Except that Microsoft has not done this with GitHub. And NPM is joining GitHub not Microsoft. You will see non login vanishing in favor of GitHub Login for sure. And the second factor, see what GitHub offers. For me that is currently a OTP generator
  - teknopaul 7y ago
    Gihub already had a masssive social graph. They know who you are in terms of who you work for and who your CTO is. Npm does not know that about me. It has no sales channel.
    - oaiey 7y ago
      GitHub is owned by the same entity that owns LinkedIn. Microsoft has really no problems cross linking persons. They can also easily link the source code between the systems etc (if they want).
      - 7y ago

sneak 7y ago

The alternative is that the entire source control system (GitHub) and the entire artifact registry (npm) are run by a giant multinational military defense contractor with close and longstanding ties to the US military. Did we forget so soon that the Snowden slides are PowerPoint? I'm not sure that's an improvement in any way whatsoever.

oaiey 7y ago
No US company is better in that regard. I prefer one with an army of lawyers. Damn, should have gone to Oracle. That is a joke. A joke!!!
crummy 7y ago
> Did we forget so soon that the Snowden slides are PowerPoint? what does that mean? That Microsoft works for the NSA or something?
- sneak 7y ago
  Microsoft does indeed work for and with the NSA. As an ASP they participate in the warrantless PRISM bulk collection program (they were the first!), and they also provide software and services (support) as a direct vendor.
jki275 7y ago
The military is a MS customer, just like nearly everyone else on the planet. Calling them a “defense contractor” is a very long stretch.
- teknopaul 7y ago
  No its not.
  - jki275 7y ago
    Boeing is a defense contractor. Northrup is a defense contractor. MS? Not even a chance. What percent do you think of their business is actually government, beyond buying licenses just like nearly every other corporation on the planet.

AkshatM 7y ago

Change my mind: package management infrastructure run by government as a public service should be the ideal end outcome for everyone. Why I think this: private or volunteer models are unsustainable in the long run owing to funding uncertainties or conflicts of interest between stakeholders. Utilities that support the bulk of our technical infrastructure should be secured by public interests. Governments can keep things free. Common objections: - "Governments are inefficient". Depends on the area. The government tends to be inefficient in handling areas with direct consumer benefit, but less so in dealing with consortiums or private entities. Since private entities are the primary mainstream users of packages, I don't think government will be too slow on this front. - "Governments will be malicious". This I don't doubt, but the solution for that is building better trust mechanisms rather than keeping a practical solution at bay, and for software at least such trust mechanisms are tenable e.g. see the CNCF's Falcon project.

teknopaul 7y ago
I like Linux's decentralized approach. That would work for Npm. Npm has enough problems that its worth running your own mirror for business continuity. Microsoft are likely to make breaking changes immediatly.
- halkcyon 7y ago
  > That would work for Npm. Npm has enough problems that its worth running your own mirror for business continuity. And risk-averse businesses do already.