10 ms·

Popular JavaScript Package Manager Npm Raises $8M, Launches Private Modules

101 points by doppp 12y ago

BinaryIdiot 12y ago
npm is a pretty important piece of node itself; I'm actually surprised Joyent hasn't picked them up (maybe they're tried?). Maybe this funding will help it iterate a little faster.
- nailer 12y ago
  There's an interview where Isaac says if npm would sell to anyone (which it wouldn't) it would definitely not be to Joyent. +1 re new stuff. npm v3 has some rad de-duplication stuff on the way.
  - gaadd33 12y ago
    If npm isn't ever going to sell out how are their VCs planning on making any return on investment? Go public? (Which is arguably selling to the public)
    - knd775 12y ago
      Well, look at Palantir. They are a very large privately owned and VC funded company with no plans to pursue an IPO.
    - bonzoT 12y ago
      hmm. I don't going public is the likely option.
  - untog 12y ago
    It's nice that Isaac doesn't want to, but what if the VCs decide he should? Do we know what the ownership breakdown is at this point?
    - nailer 12y ago
      It's possible (and probably from the investors expected) that npm Inc grows large enough that a Solaris-based hosting company wouldn't be large enough to purchase them.
- chubot 12y ago
  I'm curious if Joyent being a steward of node.js tends to convert people into paying Joyent hosting customers. I doubt that npm would be very strategic -- but first you would have to answer the question of whether node.js itself is strategic. There's certainly an element free publicity among developers. How much is that worth?
  - Osiris 12y ago
    Actually, there's a lot of movement to move the stewardship of node.js away from Joyent and into a foundation. Not being the stewards going forward, it may make less sense for them to acquire npm, especially as it's not clear how much revenue they'll be able to generate.
  - bcantrill 12y ago
    (Disclosure: I am the CTO of Joyent.) We are not and have not been the stewards of node.js to convert node.js developers into paying Joyent customers; rather, we became the stewards because we employed Ryan Dahl at the time (summer 2010), we were (and are) avid and early users of node.js ourselves, and we saw that node.js needed corporate stewardship. The node.js community has come a long way since then, of course, and earlier this year we announced our intention of moving node.js into a foundation -- which is now well underway. In terms of how node.js fits into our business, we have always been upfront that we have never monetized node.js directly: to the extent we have monetized it, it has been by offering complementary products like an IaaS platform that was designed to run node.js in production[1] and via support and services[2]. [1] http://www.slideshare.net/bcantrill/node-summit2013 http://www.slideshare.net/bcantrill/node-summit2013 [2] https://www.joyent.com/nodejs-support https://www.joyent.com/nodejs-support
- untog 12y ago
  It's an important piece of node itself, and I'm a little wary of it becoming a VC funded startup, to be honest.
  - nathan7 12y ago
    By all means not an official statement, but Isaac is quite committed to making sure that the long-term safety of the npm registry doesn't rely on the future benevolence of npm Inc.
- ilaksh 12y ago
  Lol. You missed a really interesting real-life soap opera series about io.js/Node/npm/core developers. I believe at one point isaacs wanted to do npm stuff inside Joyent but management was an issue.
Osiris 12y ago
In my company we had been using Git links in our package.json files to point to private dependencies hosted on our local GitLab instance. Recently, we setup an npm-compatible private repository that allows us to publish private packages as well as cache public ones. It's been awesome to finally get back to using semver to manage all our dependencies. Our build server automatically publishes to our private repo on a successful build. I think that a lot of companies will find this service extremely helpful and a lot cheaper than having an employee spend the time to try to set up a private repository locally.
- untog 12y ago
  Did you manage to handle versioning through Git, or is that why you set up a repo? The lack of versioning is the only thing holding the git-based solution back for me.
  - Osiris 12y ago
    No. We setup the private npm repository specifically because of the lack of support for git version tags in npm.
    - awinder 12y ago
      What's the issue with version tags? I've been cutting release branches so that I can reference github urls at a branch with a version number. Understand that it's totally not the same thing, and it's working out for right now, but feel like I'm missing the 700 lb gorilla in the room now :)
      - Osiris 12y ago
        Semver. Everything you upgrade a dependency you have to update the package.json in every other modules that uses it. With semver you can just say "^2.0.0" and always the get latest 2.x release.
- awinder 12y ago
  I had set up a private repo at a previous company around the time NPM was experiencing a lot of outages, and also to handle our private modules. It worked well when it worked well, but it did definitely require babysitting once a month or so. Totally the kind of thing you want to NOT just have one developer understand. What "npm-compatible" package did you end up going with? Assume you're not doing the couchdb mirror, which I really don't want to do again either, so I'm curious if this is a low-dependency sort of thing.
WhitneyLand 12y ago
What would be the potential business model?
balls187 12y ago
Does private modules increase the SLA of NPM? The biggest issue we face with using github and npm for deploys is the intermittent service outtages.
- Osiris 12y ago
  Setup a local npm cache. There's lots of instructions online on how to setup nginx to act as a proxy to fetch npm modules and cache them locally. This way, you don't have to worry if npmjs.com goes down, your build process will pull everything from your local cache.
  - balls187 12y ago
    Thanks, that's not a bad suggestion for our needs. I would expect a paid-for service to not require me to run my own proxy though.
- ilaksh 12y ago
  What service outages? I have seen like exactly 1 for github ever, and npm used to have issues but has been rock solid since the company launched.
mattmanser 12y ago
Do I just not get the scale? For this investment to make sense, they would have to get to $100s of million dollars, but by charging a few thousand companies $7? And I'd say there's a 50/50 chance node will completely collapse within 10 years or so. And that's being generous, javascript is a controversial language and the standards committee moves very slowly. I honestly can't see it staying king once browsers can support other languages. You only have to see how fast Ruby was a darling and even now might be regarded on its swan song, less than 10 years later. Tech changes, the next big language will hit soon. Congratulations to them and all that, and great product, I'm just wondering if someone can explain the sense in investing so much money into something like this? As this seems an incredibly risky venture?
- Igglyboo 12y ago
  > I honestly can't see it staying king once browsers can support other languages. Theres no way this happens anytime soon. Google already tried that with Dart and it failed.
  - moron4hire 12y ago
    It's funny how people forget that IE had supported multiple languages for a very long time: http://en.wikipedia.org/wiki/Internet_Explorer#Architecture http://en.wikipedia.org/wiki/Internet_Explorer#Architecture Internet Explorer does not include any native scripting functionality. Rather, MSHTML.dll exposes an API that permit a programmer to develop a scripting environment to be plugged-in and to access the DOM tree. Internet Explorer 8 includes the bindings for the Active Scripting engine, which is a part of Microsoft Windows and allows any language implemented as an Active Scripting module to be used for client-side scripting. By default, only the JScript and VBScript modules are provided; third party implementations like ScreamingMonkey (for ECMAScript 4 support) can also be used. Microsoft also makes available the Microsoft Silverlight runtime (not supported in Windows RT) that allows CLI languages, including DLR-based dynamic languages like IronPython and IronRuby, to be used for client-side scripting.
    - 12y ago
ing33k 12y ago
do they want to be like Sonatype for node.js ? http://www.sonatype.com/ http://www.sonatype.com/
- jbaruch_s 12y ago
  They'd better not. Nexus has horrible node.js support: https://www.youtube.com/watch?v=0yctqs1sN8U https://www.youtube.com/watch?v=0yctqs1sN8U Check Artifactory instead, they have first class support (Disclaimer: I am with JFrog).
kasabali 12y ago
In an alternate universe: "Popular Linux Package Manager (apt|yum) Raises $<few>M, Launches Private Repositories". Something sounds strange.
deleted 12y ago
[deleted]
deleted 12y ago
[deleted]
deleted 12y ago
[deleted]
fibo 12y ago
Npm is a good pièce software and the free public, pay for private GitHub like model wins.
- eropple 12y ago
  It wins? Does it? Because I don't see how you become a company worth nine digits of VC by selling private JavaScript package repositories to twenty thousand people. We're talking about a difference not only in degree but in kind to Github.
marknadal 12y ago
They misspelled Ryan Dahl's name :(, I miss Ryan. Congrats to Isaac and NPM, they are such great guys!
AhrowTway 12y ago
The profit model is simple: code injection into the packages to track usage and activity. Don't even think HN wouldn't engage in mental gymnastics to rationalize why it's okay to do that.

101 points by doppp 12y ago

npm is a pretty important piece of node itself; I'm actually surprised Joyent hasn't picked them up (maybe they're tried?). Maybe this funding will help it iterate a little faster.

nailer 12y ago
There's an interview where Isaac says if npm would sell to anyone (which it wouldn't) it would definitely not be to Joyent. +1 re new stuff. npm v3 has some rad de-duplication stuff on the way.
- gaadd33 12y ago
  If npm isn't ever going to sell out how are their VCs planning on making any return on investment? Go public? (Which is arguably selling to the public)
  - knd775 12y ago
    Well, look at Palantir. They are a very large privately owned and VC funded company with no plans to pursue an IPO.
  - bonzoT 12y ago
    hmm. I don't going public is the likely option.
- untog 12y ago
  It's nice that Isaac doesn't want to, but what if the VCs decide he should? Do we know what the ownership breakdown is at this point?
  - nailer 12y ago
    It's possible (and probably from the investors expected) that npm Inc grows large enough that a Solaris-based hosting company wouldn't be large enough to purchase them.
chubot 12y ago
I'm curious if Joyent being a steward of node.js tends to convert people into paying Joyent hosting customers. I doubt that npm would be very strategic -- but first you would have to answer the question of whether node.js itself is strategic. There's certainly an element free publicity among developers. How much is that worth?
- Osiris 12y ago
  Actually, there's a lot of movement to move the stewardship of node.js away from Joyent and into a foundation. Not being the stewards going forward, it may make less sense for them to acquire npm, especially as it's not clear how much revenue they'll be able to generate.
- bcantrill 12y ago
  (Disclosure: I am the CTO of Joyent.) We are not and have not been the stewards of node.js to convert node.js developers into paying Joyent customers; rather, we became the stewards because we employed Ryan Dahl at the time (summer 2010), we were (and are) avid and early users of node.js ourselves, and we saw that node.js needed corporate stewardship. The node.js community has come a long way since then, of course, and earlier this year we announced our intention of moving node.js into a foundation -- which is now well underway. In terms of how node.js fits into our business, we have always been upfront that we have never monetized node.js directly: to the extent we have monetized it, it has been by offering complementary products like an IaaS platform that was designed to run node.js in production[1] and via support and services[2]. [1] http://www.slideshare.net/bcantrill/node-summit2013 http://www.slideshare.net/bcantrill/node-summit2013 [2] https://www.joyent.com/nodejs-support https://www.joyent.com/nodejs-support
untog 12y ago
It's an important piece of node itself, and I'm a little wary of it becoming a VC funded startup, to be honest.
- nathan7 12y ago
  By all means not an official statement, but Isaac is quite committed to making sure that the long-term safety of the npm registry doesn't rely on the future benevolence of npm Inc.
ilaksh 12y ago
Lol. You missed a really interesting real-life soap opera series about io.js/Node/npm/core developers. I believe at one point isaacs wanted to do npm stuff inside Joyent but management was an issue.

Osiris 12y ago

In my company we had been using Git links in our package.json files to point to private dependencies hosted on our local GitLab instance. Recently, we setup an npm-compatible private repository that allows us to publish private packages as well as cache public ones. It's been awesome to finally get back to using semver to manage all our dependencies. Our build server automatically publishes to our private repo on a successful build. I think that a lot of companies will find this service extremely helpful and a lot cheaper than having an employee spend the time to try to set up a private repository locally.

untog 12y ago
Did you manage to handle versioning through Git, or is that why you set up a repo? The lack of versioning is the only thing holding the git-based solution back for me.
- Osiris 12y ago
  No. We setup the private npm repository specifically because of the lack of support for git version tags in npm.
  - awinder 12y ago
    What's the issue with version tags? I've been cutting release branches so that I can reference github urls at a branch with a version number. Understand that it's totally not the same thing, and it's working out for right now, but feel like I'm missing the 700 lb gorilla in the room now :)
    - Osiris 12y ago
      Semver. Everything you upgrade a dependency you have to update the package.json in every other modules that uses it. With semver you can just say "^2.0.0" and always the get latest 2.x release.
awinder 12y ago
I had set up a private repo at a previous company around the time NPM was experiencing a lot of outages, and also to handle our private modules. It worked well when it worked well, but it did definitely require babysitting once a month or so. Totally the kind of thing you want to NOT just have one developer understand. What "npm-compatible" package did you end up going with? Assume you're not doing the couchdb mirror, which I really don't want to do again either, so I'm curious if this is a low-dependency sort of thing.

WhitneyLand 12y ago

What would be the potential business model?

balls187 12y ago

Does private modules increase the SLA of NPM? The biggest issue we face with using github and npm for deploys is the intermittent service outtages.

Osiris 12y ago
Setup a local npm cache. There's lots of instructions online on how to setup nginx to act as a proxy to fetch npm modules and cache them locally. This way, you don't have to worry if npmjs.com goes down, your build process will pull everything from your local cache.
- balls187 12y ago
  Thanks, that's not a bad suggestion for our needs. I would expect a paid-for service to not require me to run my own proxy though.
ilaksh 12y ago
What service outages? I have seen like exactly 1 for github ever, and npm used to have issues but has been rock solid since the company launched.

mattmanser 12y ago

Do I just not get the scale? For this investment to make sense, they would have to get to $100s of million dollars, but by charging a few thousand companies $7? And I'd say there's a 50/50 chance node will completely collapse within 10 years or so. And that's being generous, javascript is a controversial language and the standards committee moves very slowly. I honestly can't see it staying king once browsers can support other languages. You only have to see how fast Ruby was a darling and even now might be regarded on its swan song, less than 10 years later. Tech changes, the next big language will hit soon. Congratulations to them and all that, and great product, I'm just wondering if someone can explain the sense in investing so much money into something like this? As this seems an incredibly risky venture?

Igglyboo 12y ago
> I honestly can't see it staying king once browsers can support other languages. Theres no way this happens anytime soon. Google already tried that with Dart and it failed.
- moron4hire 12y ago
  It's funny how people forget that IE had supported multiple languages for a very long time: http://en.wikipedia.org/wiki/Internet_Explorer#Architecture http://en.wikipedia.org/wiki/Internet_Explorer#Architecture Internet Explorer does not include any native scripting functionality. Rather, MSHTML.dll exposes an API that permit a programmer to develop a scripting environment to be plugged-in and to access the DOM tree. Internet Explorer 8 includes the bindings for the Active Scripting engine, which is a part of Microsoft Windows and allows any language implemented as an Active Scripting module to be used for client-side scripting. By default, only the JScript and VBScript modules are provided; third party implementations like ScreamingMonkey (for ECMAScript 4 support) can also be used. Microsoft also makes available the Microsoft Silverlight runtime (not supported in Windows RT) that allows CLI languages, including DLR-based dynamic languages like IronPython and IronRuby, to be used for client-side scripting.
  - 12y ago

ing33k 12y ago

do they want to be like Sonatype for node.js ? http://www.sonatype.com/ http://www.sonatype.com/

jbaruch_s 12y ago
They'd better not. Nexus has horrible node.js support: https://www.youtube.com/watch?v=0yctqs1sN8U https://www.youtube.com/watch?v=0yctqs1sN8U Check Artifactory instead, they have first class support (Disclaimer: I am with JFrog).

kasabali 12y ago

In an alternate universe: "Popular Linux Package Manager (apt|yum) Raises $<few>M, Launches Private Repositories". Something sounds strange.

deleted 12y ago

[deleted]

deleted 12y ago

[deleted]

deleted 12y ago

[deleted]

fibo 12y ago

Npm is a good pièce software and the free public, pay for private GitHub like model wins.

eropple 12y ago
It wins? Does it? Because I don't see how you become a company worth nine digits of VC by selling private JavaScript package repositories to twenty thousand people. We're talking about a difference not only in degree but in kind to Github.

marknadal 12y ago

They misspelled Ryan Dahl's name :(, I miss Ryan. Congrats to Isaac and NPM, they are such great guys!

AhrowTway 12y ago

The profit model is simple: code injection into the packages to track usage and activity. Don't even think HN wouldn't engage in mental gymnastics to rationalize why it's okay to do that.