Since NPM is so essential to the Javascript ecosystem, it's interesting to consider a hypothetical bankruptcy. I'm sure someone big would buy them, or they could pivot to a non profit with a crowd funding/donation based model.
Any kind of fork/split led by a company like Facebook would be highly controversial and come with lot's of drama.
This would inevitably spark a non-profit community driven alternative and cause chaos.
All outcomes would be very damaging to the JS ecosystem though.
(also, I don't see FB having any interest in running the Javascript package registry. Yarn and it's proxy are really just a result of limitations and slowness of the official implementations)
If the financial incentive for malicious actors is already represents an issue today in that there are attempts to gain control of numerous packages, imagine what the combined financial incentive would be to take over the whole index.
Which in the long run should highlight the dangers of centralization with a single point of failure. We need to move back toward a decentralized web!
A) multiple large, competing repositories
B) a distributed system like Go which relies on just a path to the source repository
Both of those suck. A) is messy and confusing, B) has a whole host of problems (no immutability, no reliability and assurance that the code will be here tomorrow, mandatory vendoring, ....).
Sure, a community driven non profit foundation in charge would be ideal, but a single source of truth, even if for profit, is much better than the alternatives.
Agreed. Maybe he meant the mirrors and how you could use them interchangeably?
But that would be strange too, considering it's just as easy to create your own npm mirror as well
JS devs keep downloading and redownloading the same stuff all over again, all the time; maybe it's time they gave some bandwidth back.