5 ms·

I thought the same thing and researched how NPM packages get deleted. They need to be manually deleted by the owner and the safeguards are all to protect depend

I thought the same thing and researched how NPM packages get deleted. They need to be manually deleted by the owner and the safeguards are all to protect dependents. There is no incentive to maintain or cleanup old npm packages you have published. They really should have some kind of automated check to clean out packages that are years old, have no imports and no recent version changes. Especially when intuitive names are claimed by a 7 year old empty repo so you have to name your project rhino-edit or some bs.

Aperocky 4y ago
> Especially when intuitive names are claimed by a 7 year old empty repo I wonder when we'll figure this out lol. The digital space is too young but once it existed for a while this must be taken care of to consider the natural human lifespan, retirement etc.
- morkalork 4y ago
  Nah, people will just make a new and improved packaging system and start over from scratch!
  - Aperocky 4y ago
    That happens for anything that does not depend on existing usage base to work. That's why you see frameworks gets invented again and again and again, because you can always just swap to the new shiny one. Doesn't work for package managers though, there's essentially no way to start from scratch unless the whole ecosystem (i.e. starting from the language itself) is new.
hughw 4y ago
They could migrate deleted ones to "Trashcan", a new npm repo where you could go to find something that may have been inadvertently swept out with the real garbage. Then you could appeal somehow to have those packages readmitted to the main repo?
- majewsky 4y ago
  The eternal flaw of NPM (and Cargo, and PyPI and so on) is that they allow namesquatting at all. It should be that you can only publish into your own user's namespace. So if I upload the "foobar" library to NPM, it can be imported as "user/majewsky/foobar" or something. And if you upload one with the same name, it would be under "user/hughw/foobar". The review barrier would be to obtain an alias into the main namespace: If I wanted to have my library be just "foobar", I would have to apply for my own library to be aliased to that name. And then there could have to be some sort of notability requirement for those "nice" names.
  - deleted 4y ago
    [deleted]
  - derkades 4y ago
    I agree, this seems to work quite well for Docker Hub

Aperocky 4y ago

> Especially when intuitive names are claimed by a 7 year old empty repo I wonder when we'll figure this out lol. The digital space is too young but once it existed for a while this must be taken care of to consider the natural human lifespan, retirement etc.

morkalork 4y ago
Nah, people will just make a new and improved packaging system and start over from scratch!
- Aperocky 4y ago
  That happens for anything that does not depend on existing usage base to work. That's why you see frameworks gets invented again and again and again, because you can always just swap to the new shiny one. Doesn't work for package managers though, there's essentially no way to start from scratch unless the whole ecosystem (i.e. starting from the language itself) is new.

hughw 4y ago

They could migrate deleted ones to "Trashcan", a new npm repo where you could go to find something that may have been inadvertently swept out with the real garbage. Then you could appeal somehow to have those packages readmitted to the main repo?

majewsky 4y ago
The eternal flaw of NPM (and Cargo, and PyPI and so on) is that they allow namesquatting at all. It should be that you can only publish into your own user's namespace. So if I upload the "foobar" library to NPM, it can be imported as "user/majewsky/foobar" or something. And if you upload one with the same name, it would be under "user/hughw/foobar". The review barrier would be to obtain an alias into the main namespace: If I wanted to have my library be just "foobar", I would have to apply for my own library to be aliased to that name. And then there could have to be some sort of notability requirement for those "nice" names.
- deleted 4y ago
  [deleted]
- derkades 4y ago
  I agree, this seems to work quite well for Docker Hub