5 ms·

didn't know npm was owned by github.. well, that explains things...

joeyhage 4mo ago
Most people know this but the _real_ reason it explains things is that GitHub is owned by Microsoft. Oh, and Microsoft moved GitHub to Azure
- amitport 4mo ago
  To be fair, NPM sucked long before it got acquired by Github/Microsoft. And to be fair 2: The other package repos also suck.
  - tempay 4mo ago
    To be fair, the entire problem space sucks and I’m not sure it’s possible not to.
  - jbverschoor 4mo ago
    Yeah, but the azure supply chain attack explains why all of a sudden they can make this change. It seems that if you want to get something important changed in npm, you simply need exploit some of its short comings against Microsoft instead of discussing why it’s necessary.
  - creesch 4mo ago
    > And to be fair 2: The other package repos also suck. If you mean other languages, then yeah a lot of similar issues and weirdness there as well. Maven dependencies in any complex project are a "fun" challenge as well. Though the sort of recurring supply chain attacks you see within the npm ecosystem is something I haven't seen elsewhere to this degree.
  - hinkley 4mo ago
    Maybe I have nostalgia blinders on but I do NOT remember putting up with this much bullshit in the Ruby ecosystem and I didn't even like ruby. Gemfiles were pretty okay, and gemfiles are what everyone assumed npm would be a copy of. It wasn't.
    - amitport 4mo ago
      [dead]
BowBun 4mo ago
yes, since 2020
shagie 4mo ago
NPM Is Joining GitHub - https://news.ycombinator.com/item?id=22594549 https://news.ycombinator.com/item?id=22594549 (March 16, 2020; 571 comments; 1829 points) - https://github.blog/news-insights/company-news/npm-is-joining-github/ https://github.blog/news-insights/company-news/npm-is-joinin... Some of it aged... interesting. Top comment: > Microsoft doesn’t do everything right but the GitHub acquisition has honestly gone better than I ever expected. Rather than forcing GitHub to adopt Microsoft centric policies, Microsoft has adopted more GitHub stuff, especially from a product POV. GitHub still runs as a separate company (different logins and health care and hiring systems) with its own policies and point of view. > ...
- w29UiIm2Xz 4mo ago
  To be fair, the vibes (at the time) were that Microsoft has changed. Probably, in some way, a zero-interest rate phenomena.
  - ok_dad 4mo ago
    Young people thought M$ was changing, the old folks knew it was just another cycle of embrace, extend, extinguish.
    - Dylan16807 4mo ago
      Microsoft has been causing a lot of problems lately but I completely disagree that it fits the pattern of "embrace, extend, extinguish".
    - tyre 4mo ago
      Young people were… right? VS Code is open source. (Cursor is built on it!) GitHub didn’t embrace, extend, extinguish git. You can git push to a different company (e.g. Gitlab) and you’ve migrated. The biggest problems with GitHub are scaling and availability, not lock-in. Microsoft today is nothing like it was 30 or 20 years ago. Fifteen years ago we were writing HTML and JavaScript specifically for Internet Explorer. Edge is built on Chromium.
ralph84 4mo ago
NPM (the company) was about to go under in 2020. They raised VC but never found a sustainable business model. GitHub acquired them to keep the ecosystem alive. The acquisition hasn't really benefitted GitHub much at all.
- materielle 4mo ago
  I don’t know if this is the case here, but it’s very hard in general to judge how much software projects ought to cost. Software projects will grow in complexity to consume whatever budget you give it. If you hire 50 devs and give them a bunch of business objectives, they are going to do what they do and write a ton of software. It’s not obvious to me that it would be theoretically impossible to build a cheaper package manager.
  - monster_truck 4mo ago
    And additionally was it truly worth buying if this is what we've ended up with? Some things should be allowed to fail
    - arcatek 4mo ago
      Eh, easy to say. Remember how Sourceforge started shipping ads in binaries people downloaded? If you think failing was the worst scenario, you lack imagination.
- hinkley 4mo ago
  No there are gobs of node projects on GitHub. I'm sure someone did the math on how many paying customers would have been fucked if npm.org went away and it worked as a loss leader.
domh 4mo ago
I knew it was owned by github, but this is the first time I've personally seen the release notes on github's blog instead of npm's.

Most people know this but the _real_ reason it explains things is that GitHub is owned by Microsoft. Oh, and Microsoft moved GitHub to Azure

amitport 4mo ago
To be fair, NPM sucked long before it got acquired by Github/Microsoft. And to be fair 2: The other package repos also suck.
- tempay 4mo ago
  To be fair, the entire problem space sucks and I’m not sure it’s possible not to.
- jbverschoor 4mo ago
  Yeah, but the azure supply chain attack explains why all of a sudden they can make this change. It seems that if you want to get something important changed in npm, you simply need exploit some of its short comings against Microsoft instead of discussing why it’s necessary.
- creesch 4mo ago
  > And to be fair 2: The other package repos also suck. If you mean other languages, then yeah a lot of similar issues and weirdness there as well. Maven dependencies in any complex project are a "fun" challenge as well. Though the sort of recurring supply chain attacks you see within the npm ecosystem is something I haven't seen elsewhere to this degree.
- hinkley 4mo ago
  Maybe I have nostalgia blinders on but I do NOT remember putting up with this much bullshit in the Ruby ecosystem and I didn't even like ruby. Gemfiles were pretty okay, and gemfiles are what everyone assumed npm would be a copy of. It wasn't.
  - amitport 4mo ago
    [dead]

BowBun 4mo ago

yes, since 2020

shagie 4mo ago

NPM Is Joining GitHub - https://news.ycombinator.com/item?id=22594549 https://news.ycombinator.com/item?id=22594549 (March 16, 2020; 571 comments; 1829 points) - https://github.blog/news-insights/company-news/npm-is-joining-github/ https://github.blog/news-insights/company-news/npm-is-joinin... Some of it aged... interesting. Top comment: > Microsoft doesn’t do everything right but the GitHub acquisition has honestly gone better than I ever expected. Rather than forcing GitHub to adopt Microsoft centric policies, Microsoft has adopted more GitHub stuff, especially from a product POV. GitHub still runs as a separate company (different logins and health care and hiring systems) with its own policies and point of view. > ...

w29UiIm2Xz 4mo ago
To be fair, the vibes (at the time) were that Microsoft has changed. Probably, in some way, a zero-interest rate phenomena.
- ok_dad 4mo ago
  Young people thought M$ was changing, the old folks knew it was just another cycle of embrace, extend, extinguish.
  - Dylan16807 4mo ago
    Microsoft has been causing a lot of problems lately but I completely disagree that it fits the pattern of "embrace, extend, extinguish".
  - tyre 4mo ago
    Young people were… right? VS Code is open source. (Cursor is built on it!) GitHub didn’t embrace, extend, extinguish git. You can git push to a different company (e.g. Gitlab) and you’ve migrated. The biggest problems with GitHub are scaling and availability, not lock-in. Microsoft today is nothing like it was 30 or 20 years ago. Fifteen years ago we were writing HTML and JavaScript specifically for Internet Explorer. Edge is built on Chromium.

ralph84 4mo ago

NPM (the company) was about to go under in 2020. They raised VC but never found a sustainable business model. GitHub acquired them to keep the ecosystem alive. The acquisition hasn't really benefitted GitHub much at all.

materielle 4mo ago
I don’t know if this is the case here, but it’s very hard in general to judge how much software projects ought to cost. Software projects will grow in complexity to consume whatever budget you give it. If you hire 50 devs and give them a bunch of business objectives, they are going to do what they do and write a ton of software. It’s not obvious to me that it would be theoretically impossible to build a cheaper package manager.
- monster_truck 4mo ago
  And additionally was it truly worth buying if this is what we've ended up with? Some things should be allowed to fail
  - arcatek 4mo ago
    Eh, easy to say. Remember how Sourceforge started shipping ads in binaries people downloaded? If you think failing was the worst scenario, you lack imagination.
hinkley 4mo ago
No there are gobs of node projects on GitHub. I'm sure someone did the math on how many paying customers would have been fucked if npm.org went away and it worked as a loss leader.

domh 4mo ago

I knew it was owned by github, but this is the first time I've personally seen the release notes on github's blog instead of npm's.