Hacker News Reader

Comment by evv | Hacker News Reader

All of the drama around the npm firings has sparked an interesting discussion in the JS community: does it even make sense to trust a for-profit corporation with the world's supply of JS?

One of the creators of unpkg.com is considering a fork of the registry: https://twitter.com/mjackson/status/1119355707055165441

Meanwhile, yarn (a popular alternative to the npm client), uses a proxy to NPM so they can change the default registry of all yarn clients, if they choose to.

As it stands, npm is the centralized source of truth for all our JS packages, and historical versions. We have no guarantees about the future of npm. Aside from a relatively clean history, we have no reason to trust them. For every dollar of VC money that they have taken, we have a reason to believe the registry won't last in its current form. This is scary.

View on HN

>does it even make sense to trust a for-profit corporation with the world's supply of JS?

No. Javascript, despite its flaws, was already one of the freest, easily accessible and deployable programming languages in existence. It flourished throughout the web without any gatekeepers or centralized authority, and it never needed the ecosystem of overwrought complexity and BS that it has.

Not only does it not make sense for NPM to have de facto control over that language through a single, proprietary registry and a single package manager, it further makes no sense that in the intervening years, with all of the issues NPM has had, no serious attempt at competition or re-decentralization of the JS community has even been attempted.

Unfortunately, I feel like the baby has long ago been thrown out with the bathwater, and NPM's ubiquity and network effect has made it "too big to fail," despite failing constantly. Maybe we can just start over once NPM has finally burned to the ground and taken the web with it.

I feel this is proved false by history, if npm wasn't needed because everything was fine, it wouldn't have flourished.

You seem to assume that all successful projects succeed on their own merit in a fair market, but that's not always the case. NPM's success is due in large part to enterprise investment and hype. Part of the reason for enterprise investment is controlling costs by not having to train or recruit developers for another language besides Javascript, which was already commonplace.

And even if NPM did solve a needed problem, better solutions cannot be considered due to those entrenched business interests and the extreme centralization of the javascript community, not because NPM is already the best possible solution to whatever problems it claims to solve.

JQuery was revolutionary in its own time, but you didn't see a JQuery Foundation serving all JQuery plugins from a closed repository through a buggy package manager that everyone was expected to use. It is possible to innovate and not monopolize, but what NPM has done, at best, is monopolize innovation and stop it dead in its tracks.

It flourished because it is installed by default and thus became the defacto standard.

There is a talk from Nodejs' creator where he mentions one of his biggest regrets about Node is that he made NPM the default.

„Apart from a clean history...“ is a pretty strong caveat.

Our times are seeing a breakdown of trust. News media, companies, and politicians are considered corrupt by default. Yet trust is the single most important ingredient to organize a complex society.

Those advocating to “trust no one” always have complex theories on how some organization’s incentives are corrupting them: “they only want to print the news that benefit their advertisers” etc. But such accusations are easy to make and essentially impossible to prove if you just discount the evidence that is historic behavior. Scientists are also just “in it for the money” even when they have tenure (global warming), charities “have their own motives to exaggerate”, and so on.

If NPM turns to the dark side, the impact on any individual user of their repository is likely to be minimal, and barriers to switching to some other repo are minimal. So at least from the users’ perspective, the downside of extending them a bit of trust seems to be limited.

I always star the main packages I use on GitHub but I realize I'm missing out on the required packages being used as well. It would be nice if an alternative sprung up that was p2p truly decentralized by developers and intertwined with where developers typically host their repositories.

What does starring on GitHub accomplish? Isn't it just like a bookmark?

It's sometimes used as a proxy to signal how "important" and "popular" something is.

> All of the drama around the npm firings has sparked an interesting discussion in the JS community: does it even make sense to trust a for-profit corporation with the world's supply of JS?

Don't we do the same with other companies such as RedHat?

How open is NPM's infrastructure? Can it be forked?

> Don't we do the same with other companies such as RedHat?

Not really. While most major Linux distributions are managed by for-profit companies, there's enough of them to provide legitimate competition and something you can call an open market.

With NPM, there's yarn, but not really, since that's only the client. For all intents and purposes, distributing a Javascript library is only realistically possible through NPM right now.

Also, better comparisons are perl, python, ruby, etc. Many other languages have centralized package repositories, but they aren't controlled by a for-profit, venture-backed company.

I'm sympathetic to the idea that npm inc's model is a new way to develop and operate a language's repo sustainably. Python, for example, has struggled to get the resources to evolve theirs. I'm not sure npm's approach is working well in practice, though.

"Potential threat" trading in modern world is ridiculous. Why doesn't it smell ultra iatrogenic for anyone?

i·at·ro·gen·ic (ī-at'rō-jen'ik), Denoting response to medical or surgical treatment, usually denotes unfavorable responses.

Reply on news.ycombinator.com