Is Express.js dying?
github.com
github.com
It looks like IBM is making some predictable mistakes, which have disillusioned dougwilson to some large extent. Simultaneously they are being fairly inflexible at fixing those mistakes and ultimately forcing abandonment, at least by dougwilson. My prediction:
1) IBM continues with the typical corporate policies which are probably not great for the sort of OSS project that involves independent contributors
2) dougwilson leaves permanently
3) the project sort of wallows a bit
4) IBM puts some resources on it, and claims it all worked out.
As to #4, they'll be sort of correct, assuming the goal was to see resources and progress on express. They'll be wrong if the goal was to properly maintain an open source community around the project.
NOTE: I don't know anything about this, but I've seen this play out many times before. I chimed in here because the other comments in this thread seem to be wildly off topic given the content of the github discussion.
This tracking is not only unethical but exceptionally dangerous, as the dependency is fetched over http, and as we know, npm modules essentially have full user access as they can spawn any command via the `postinstall` hook. So a mitm could pose as blip.strongloop.com and own any servers calling out to it.
I've ended up forking every strongloop package we use to trim this tracking abuse. I really shouldn't have to do that.
https://github.com/strongloop/express/issues/2264
Back then, many in the community were surprised by the sponsorship (sale?) of the project and called for the repo to be transferred to the Expressjs org instead. So the question of ownership has been a long-running issue.
Now the ownership/involvement seems to have passed from Strongloop to their acquirer IBM. We're just seeing Doug/the community reprise the same issue with the new owners.
Doug (and presumably other third-party contributors) naturally won't want to be the main contributors to a project owned by a company, so the IBM guys will probably have to take over development & maintenance no matter what. (Barring them giving the project back to the organisation.) Chance of a fork too.
I guess a shared governance model is needed here, to get all parties aligned again.
That's why we have MariaDB and a whole raft of other projects that are technically closely related to the original and maintained by a number of people that were originally associated with the project but that moved on after an acquisition by forking the project.
Companies as a rule do not like the kind of autonomy that is associated with FOSS.
Maybe this is a solution in this case too, Doug could in theory fork it under a different name and just keep it running (unless his contract prevents him from doing that).
More fundamentally, I feel the "web framework" doesn't need to be an exciting piece of the stack anymore, like was the case maybe ten years ago. Routing URLs and gluing together middleware doesn't need to be "interesting" or "cutting-edge".
It's great that Express makes it easy, and I'm happy to keep using it regardless of whether there's a version 5 and 6 and 7 in the works.
Those are not easy maintenance things to do, and certainly are important.
There's nothing in ES6 that warrants breaking Express's compatibility with older runtimes. And HTTP 2.0 probably is better off in a new framework that's designed from scratch for it. (I'm not a great fan of HTTP 2.0 and would rather see Express unburdened by its complexity.)
Compare it to Linus' openly-hostile dictatorship, which is universally both reviled and excused by contributors, just for a moment: At least when it comes to Linux kernel, shit gets done; nobody has to question the commitment of the project's stewards; and Linus hasn't (that I recall) threatened to take his toys elsewhere.
If Linux had been, somehow, acquired by a large company (or, at least, access/edit rights to all of the code repositories and web presence and such), and Linus had been removed from administrative roles on those repositories and sites (or asked to remove himself and others), then the comparison would be fair.
Admittedly, one answer would be to loudly fork the project. That's happened on a number of occasions. Joomla forked from whatever it was called before a similar story (Mambo, maybe?). Node.js itself forked into io.js over similar disagreements (and then people worked those disagreements out).
I suspect some of the back and forth happening is people trying to figure out if a fork is necessary and if they actually want to be the people leading the fork (sounds like Doug Wilson does not want to be a leader, but wants to keep contributing). Contributing heavily to a project is not the same as being a leader of a project, and it is entirely fair to not want to lead a project, even if you care strongly about it, and have worked hard on it for a long time.
My takeaway was that Doug (who, I should clarify/add, I have a lot of respect for as a hard working OSS guy, but lost a few brownie points from me for this soap opera) actually did want to lead the community effort: "I ask them if I can take over the project in order to be the leadership and ensure this gets moved on," we're his exact words. I guess that is an exemplar of why committed project stakeholders need to get their messaging straight before pointing fingers: You and I had different interpretations of the actors' motivations.Nobody wins when fingers are pointing everywhere. At least someone wins when a stakeholder says, "screw you guys, I'm going to do what I know is right rather than vent about what I know is wrong." EDIT: And to his credit, Doug did try to mitigate the problems he saw with the project. I don't know why he didn't take that one last step of trading on his good name and fork the project.
In my opinion, StrongLoop folks are hard working people, more than casually invested in the nodejs community. Even the controversial npm tracking could be argued to be a logical act, to help them understand more about how their projects are used than npm can tell them. Politics (and an unfortunate exit) got the best of them.
Doug is a hard working guy. And more than casually invested in the nodejs community. Politics got the best of him, too.
I believe Doug will come to regret his participation in this drama, and will quietly go back to writing great software and leading great projects, having learned an important lesson: don't believe for a moment that BigCo gives a tiny rat's ass about you or your community's sensibilities, just be the best dev/leader you can be and don't hand the keys to anyone who isn't a trusted driver. And if they take those metaphorical keys anyway, well then, that's what forks are for.
Anyway, that's how I read it all. I agree that we are interpreting things differently, and I'm probably missing a lot of detail here. I scanned the thread and missed some details you've called out. But, I tend to take an optimistic approach to stuff like this. If someone has proven they're mostly a "head down get shit done" kinda person, I'm not gonna sweat it when they pop their head up and rant for a little while when things go pear-shaped. I'd probably rant, too, if something I was working on was being killed by a corporate overlord. Then I might decide to fork the thing.
This "soap opera" isn't of Doug's making. What he's saying seems very fair to me: he's willing to work on it if it's a community effort, and not under a corporate banner. Throughout the thread, he gives excellent reasons which justify his stand.
> The whole thing should've been on the IBM back channels until they got their shit together and could agree on some messaging
Earlier, you said this should have been solved in IBM's internal channels. Why? Doug doesn't work for IBM, and doesn't owe them anything. He's well within his rights to protest or complain openly, irrespective of how it affects IBM.
> don't hand the keys to anyone who isn't a trusted driver
Here's a link that explains what happened https://github.com/strongloop/express/issues/2264
> just be the best dev/leader you can be ...
Oh come on! We should be thankful for the effort so many talented people are putting in FOSS, often for no financial gain.
You are correct: Doug does give excellent reasons for supporting the project under the expressjs org, the same reasons brought up back when the github ownership of the project changed (as in the issue you linked). The public debate only served to confuse and frustrate watchers, and that is the "soap opera" I refer to.
It's unfortunate that sometimes such public drama is necessary to effect change, but as evidenced by the issue raised when the repo was taken over originally, public drama wasn't going to effect any change here. It now serves only to foment ill-will and promote confusion, regardless of who is "right".
You are also right that we should be thankful for OSS contributors' efforts. I am thankful for his. For StrongLoop's too, in fact. I am, however, not thankful for the wasted energy in maintaining the debate on a github issue, when the debate didn't do any good the first time 'round. I am not thankful that politics have derailed the work.
EDIT: I think you misunderstood my "be the best..." comment. I was merely suggesting that Doug would find himself less stressed if he was able to focus on doing what he loves and not playing politics.
Apparently IBM threw a few guys into discovery on the project a few weeks ago and they may actively get involved, but it is yet to be seen. Maybe IBM just wants to own it and doesn't care what happens to the project one way or the next. I have no way of knowing what IBM's intentions are, and I think that's the concern of the maintainer, dougwilson.
"I continue to work in community-owned organizations on GitHub, and if Express were to ever join a community org like "expressjs", I may be back."
Yikes.
The project is incredibly popular. When it comes to community PRs, it's hard for people to swallow sometimes but often a PR isn't good enough or doesn't fit the vision of the project. It's easy to break things in the process of improving or fixing something, and perhaps Express has hit a bit of a stability point which is great.
I do think there is increased competition though as well from other frameworks.
https://github.com/koajs/response-time/blob/master/index.js
The response time middleware records the start time, then yields to any other middleware, and finally sets the header.
You just can't do that as nicely in Express. Here is the Express version:
https://github.com/expressjs/response-time/blob/master/index...
responseTime has to wait to be called via "on-headers". on-headers is a separate module that monkey-patches response.writeHead.
The Koa version is 21 lines of code (really just 4 LOC), while the express version is over 200 LOC.
Whose decision was it to go from a "batteries included" web server module to one where users had to assemble a bunch of ad-hoc third party components to make a usable web server? I'm looking at you, body-parser.
Body-parser does have issues, though. :)
https://github.com/strongloop/express/issues/2827
The link is from the fifth comment.
When developing in node it makes a lot of sense to use lots of different modules for the one project. At work I have a good dozen or so, it really helps with iteration and testing.
without commit access...
Linux would be under the 'Linus Project Governor' model or the LPG... ;)
What about es6 isn't compatible with express?
All that said, Koa is pretty great and teams should adopt it.
However I would likely chose something different if my needs were different. If I wanted to implement REST APIs in Node I would use Hapi. If I wanted to build more complex web apps I might look into Koa (although I don't think I'll ever move back to classic server-only rendered apps).
Express is my JS equivalent of Ruby's Sinatra and Python's Flask. Nothing more, nothing less.
Addendum: I wouldn't say "everyone" has switched to Koa. Koa was handicapped by its conceptual overhead for most ordinary express users in its early days (relying on a combination of generators and promises -- both not yet sufficiently widely established and understood technologies at the time -- to build coroutines, which even fewer people understood). It has improved and the JS community seems to have caught up (just look what's going on with the Redux ecosystem -- "thunks" and "sagas" (essentially built around coroutines) are beginning to see some traction). But it didn't initially deliver the same "read this tutorial, start building apps" experience express had.
4 Million downloads per month for Express [1] (vs 60K/mo for Koa [2]) .. doesn't look like everyone is switching.
[1]: http://npm-stat.com/charts.html?package=express&author=&from...
[2]: http://npm-stat.com/charts.html?package=koa&author=&from=201...
Express.js is actually a combination of various modules. If you want to see the work being done, go to those individual modules.
I've flagged it for mod review, I'm not sure if this should be on the front page, it doesn't seem like it meets the requirements for HN.
If you don't think it's front-page worthy, then just don't upvote. Flagging is meant for off-topic or spam, which this is clearly not.
That info by itself seems HN worthy as many of us have likely used Express as the "safe" choice when starting a new project. Time to rethink that...
As for the future of Express: I've only had the opportunity to get together with Doug in person once, but we've talked about this a few times in the past. I can guarantee you the last thing he wants is drama, so I'll leave the ball completely in his court there.
I will say this though: keep an eye on Doug's federated projects (jshttp and Pillar). Whether or not the various pieces are released as Express 5 or not, the _code base_ is still improving and becoming increasingly standardized, regardless of the monicker. More on that: https://github.com/balderdashy/sails/pull/3235#issuecomment-...
However, there are very clearly some governance issues that those of us using Express or evaluating it should be aware of.
I have experienced exactly this multiple times. In fact, I am extremely aware of this when I start a new project. Perhaps especially when I am dealing with frameworks like Express, Django or Ruby on Rails.
If I recall correctly, Gary Bernhardt, said it well: "Treat Rails like a disease and isolate yourself." You can replace "Rails" with any popular framework. Yourself in this quote referes to the business logic of your system.