At this point it's clear that a union isn't going to save NPM. The company is really in no position to guarantee anyone anything.
Since NPM is so essential to the Javascript ecosystem, it's interesting to consider a hypothetical bankruptcy. I'm sure someone big would buy them, or they could pivot to a non profit with a crowd funding/donation based model.
Any kind of fork/split led by a company like Facebook would be highly controversial and come with lot's of drama.
This would inevitably spark a non-profit community driven alternative and cause chaos.
All outcomes would be very damaging to the JS ecosystem though.
(also, I don't see FB having any interest in running the Javascript package registry. Yarn and it's proxy are really just a result of limitations and slowness of the official implementations)
A) multiple large, competing repositories
B) a distributed system like Go which relies on just a path to the source repository
Both of those suck. A) is messy and confusing, B) has a whole host of problems (no immutability, no reliability and assurance that the code will be here tomorrow, mandatory vendoring, ....).
Sure, a community driven non profit foundation in charge would be ideal, but a single source of truth, even if for profit, is much better than the alternatives.
Agreed. Maybe he meant the mirrors and how you could use them interchangeably?
But that would be strange too, considering it's just as easy to create your own npm mirror as well
JS devs keep downloading and redownloading the same stuff all over again, all the time; maybe it's time they gave some bandwidth back.
If the financial incentive for malicious actors is already represents an issue today in that there are attempts to gain control of numerous packages, imagine what the combined financial incentive would be to take over the whole index.
Which in the long run should highlight the dangers of centralization with a single point of failure. We need to move back toward a decentralized web!
Selectively firing people may actually improve morale for the obedient types. Think about it, you follow all the written and unwritten rules, you always step back, you don't cause dissent - what do you get in return? Well, you don't get fired. But if nobody ever gets fired for these reasons, you're going to feel like a sucker.
In the US there's still this myth of the "disruptive innovator" who naturally breaks all the rules and yet redeems himself as a worker unit, despite all the issues they're causing. In Japan or Korea by contrast, none of this would fly. Obedience is a must. There's no space for disruption. Would you deny the success of Korean or Japanese businesses?
Indeed. And it's much worse outside our industry. Hearing stories from friends and family who work regular jobs (i.e. not specialized, well-paid, in high demand) is what makes me convinced unions are a must.
That said, with the existence of Verdaccio allowing companies to run private repositories within the firewall and at no cost beyond infrastructure, who is paying for private npm?