7 ms·

Are you going to get upset at node for calling home to Microsoft (npm owned by github owned by microsoft) when using the supplied package management too?

ocdtrekkie 4y ago
I mean, I strongly just feel the npm ecosystem is a dumpster fire of sadness. Though there is a fundamental difference in that if you use NPM, you are choosing to download packages from NPM. But if you specify a bunch of repos you want to download Go packages from, and you get them from Google anyways, that's pretty uncomfortable. Especially if Google is in turn also DDoSing the repos in return.
- pretext-1 4y ago
  No I did not "choose to download packages from NPM". Choosing means there is an alternative. And besides that the registry part is invisible in your package file (hardcoded default like GOPROXY). If you look at it, it's pretty similar. The part before the first slash is invisible: npmjs.com/org/package proxy.golang.org/org.com/package The difference with Go is that you can actually change the first part if you want, or even disable it.
bsder 4y ago
Yes. I find all of the modern "always connected, always call home" behaviors quite annoying in my programming tools. But, to be fair, Node was a dumpster fire long before being bought by Microsoft.
- deleted 4y ago
  [deleted]
ezfe 4y ago
How could node not do that? NPM hosts all the packages so of course it does.
- pretext-1 4y ago
  They could do it similar to Go. Instead of "facebook/react" it could be "facebook.com/react" in "package.json".
  - ezfe 4y ago
    Well yes, but my point here is that NPM's entire design is around not doing that - whereas Go's design isn't
- my69thaccount 4y ago
  IPFS/bittorrent for P2P
jaywalk 4y ago
If you're pulling down a packge with npm that isn't part of the npm registry, the request isn't going through a Microsoft proxy.
- sangnoir 4y ago
  Same for Go, only thsy Go has an opt-out "registry" rather than opt-in.
dgb23 4y ago
The problems with npm are completely orthogonal to what the author is describing here.
my69thaccount 4y ago
I mean, yes, it would be valid to complain about that as well

ocdtrekkie 4y ago

I mean, I strongly just feel the npm ecosystem is a dumpster fire of sadness. Though there is a fundamental difference in that if you use NPM, you are choosing to download packages from NPM. But if you specify a bunch of repos you want to download Go packages from, and you get them from Google anyways, that's pretty uncomfortable. Especially if Google is in turn also DDoSing the repos in return.

pretext-1 4y ago
No I did not "choose to download packages from NPM". Choosing means there is an alternative. And besides that the registry part is invisible in your package file (hardcoded default like GOPROXY). If you look at it, it's pretty similar. The part before the first slash is invisible: npmjs.com/org/package proxy.golang.org/org.com/package The difference with Go is that you can actually change the first part if you want, or even disable it.

bsder 4y ago

Yes. I find all of the modern "always connected, always call home" behaviors quite annoying in my programming tools. But, to be fair, Node was a dumpster fire long before being bought by Microsoft.

deleted 4y ago
[deleted]

ezfe 4y ago

How could node not do that? NPM hosts all the packages so of course it does.

pretext-1 4y ago
They could do it similar to Go. Instead of "facebook/react" it could be "facebook.com/react" in "package.json".
- ezfe 4y ago
  Well yes, but my point here is that NPM's entire design is around not doing that - whereas Go's design isn't
my69thaccount 4y ago
IPFS/bittorrent for P2P

jaywalk 4y ago

If you're pulling down a packge with npm that isn't part of the npm registry, the request isn't going through a Microsoft proxy.

sangnoir 4y ago
Same for Go, only thsy Go has an opt-out "registry" rather than opt-in.

dgb23 4y ago

The problems with npm are completely orthogonal to what the author is describing here.

my69thaccount 4y ago

I mean, yes, it would be valid to complain about that as well