Hacker News Reader

Comment by larkeith | Hacker News Reader

As evv brought up [1], it's rather concerning that the cornerstone of the JS ecosystem is a for-profit organization (especially one lacking in a source of aforementioned profit). I wonder if their bankruptcy might not be the worst thing for the community, in the long term - it would certainly discourage relying on a single fallible repository in the future.

[1] https://news.ycombinator.com/item?id=19725139

View on HN

The only alternatives to a single source of truth repository are

A) multiple large, competing repositories

B) a distributed system like Go which relies on just a path to the source repository

Both of those suck. A) is messy and confusing, B) has a whole host of problems (no immutability, no reliability and assurance that the code will be here tomorrow, mandatory vendoring, ....).

Sure, a community driven non profit foundation in charge would be ideal, but a single source of truth, even if for profit, is much better than the alternatives.

I strongly prefer Go's "option B" over node_modules. Your concerns (immutability, reliability, and general code existence) are handled by vendoring. Vendoring has the added benefit of enabling project builds without additional HTTP dependencies; entirely avoiding the "left-pad" problem class. I wish my NPM projects were so easy.

There are other models. CPAN, for instance, has worked incredibly well for its audience for 25 years and counting.

https://www.cpan.org

But, unless I'm missing something, CPAN is a centralized registry, just like npm?

I was more getting at the governance model. You didn't say this, but the direction of the discussion seemed to be that centralized metadata == for-profit.

> The master CPAN site is hosted by Phyber in Los Angeles,

Agreed. Maybe he meant the mirrors and how you could use them interchangeably?

But that would be strange too, considering it's just as easy to create your own npm mirror as well

C) Content addressing, Torrent/IPFS style.

JS devs keep downloading and redownloading the same stuff all over again, all the time; maybe it's time they gave some bandwidth back.

Reply on news.ycombinator.com