Show HN: Open-Registry – Distributed Package Registry Owned by the Community | Hacker News Reader

Show HN: Open-Registry – Distributed Package Registry Owned by the Community

open-registry.dev

68 pointsdiggan11 comments

It’s nice to see these initiatives. A couple of points of feedback:

- There’s a lot of talk about open but I want to see names, faces, keys, of the people in control. Who runs the domain? DNS? Etc. Who is behind this?

- What’s the point of mirroring NPM? Why not fork the registry and add your own features that aim to make it more reliable and secure?

This really isn't an open registry or distributed package registry. It is yet another JavaScript registry. Also, check out Verdaccio.

FYI, Chrome will not let me load this site.

> Your connection is not private / Attackers might be trying to steal your information from open-registry.dev (for example, passwords, messages, or credit cards). / NET::ERR_CERT_COMMON_NAME_INVALID

Huh, sounds weird and first time I hear this. ".dev" needs to be over HTTPS, could be that something is in the way and forcing the HTTP version on your side?

Are others having the same problem?

Just tested it with Google Chrome Version 70.0.3538.77 (Official Build) (64-bit) on Arch Linux, and not seeing any issues.

Major Browsers have HTTPS pinned on all .dev domains

it looks like one of letsencypt's new certs that has been signed under their own authority intsead of being cross-signed.

when was the last time you updated your browser/os?

> when was the last time you updated your browser/os?

All is current—Chrome 74.0.3729.131 on macOS 10.14.5 beta. This is on my primary box (so lots of browsing) and I don't think I've seen that error before.

Fantastic effort, I really hope this gains some traction.

Thanks a lot! I'm biased, but I hope so too :)

Why is “JavaScript” nowhere in the headline of this story? It’s specific to a single ecosystem.

I like the idea (as with any open stuff). I’m just not sure I see the use.

Reply on news.ycombinator.com