Hacker News Reader

Comment by mtm7 | Hacker News Reader

Out of curiosity, what benefits does Microsoft/GitHub get from owning a package registry? I'd be fascinated to learn more about their long-term strategy here.

View on HN

Others have commented on why the acquisition makes strategic sense from a technological perspective, but I think it's also important to consider how it makes strategic sense from a psychological perspective. For a long time, devs loved bagging on Microsoft. I once saw some Microsoft guys demo something cool at a conference, and they had to basically apologize that they were from Microsoft, because dev sentiment toward the organization was so negative, even though they were doing cool stuff.

The acquisition of GitHub was absolutely intended to capture a tool/ecosystem that developers liked using and benefit from that positive sentiment. That's why Microsoft has been so cautious about branding GitHub as a Microsoft property out the gate. It's trying to ease devs into the idea that the company is something devs can like, and I wouldn't be surprised if this psychological strategy is at work with the npm acquisition, too.

Accruing positive sentiment in the dev community through acquisitions of someone else's nice things. Who came up with that crazy idea? GitHub isn't Microsoft. You can't buy brand loyalty.

Ah, but they can. The older folks will remember GitHub being a separate thing but as hundreds of thousands of new devs enter the ecosystem every year, they are introduced to a cool GitHub tool by Microsoft. They don’t know that it was separate nor the animosity towards MS.

You can’t change people’s minds on emotional baggage like this. You just wait for them to die off/retire and target the new blood.

Personally I've always found GitLab's design much more user friendly and the code and repository layout is much nicer than the spartan and cold GitHub.

About all Microsoft has dared to change (at least transparently) since obtaining GitHub has been the pricing page, and objectively speaking right now... it's a hot confusing mess.

A mascot featuring tentacles is all too fitting here. I don't know a lot about NPM or JS but it's being described as a dumpster fire which is also all too fitting. And I'm able smirk as I write that with no animosity or skin in the game.

Actually they may have done updates to the fonts which overall look slightly larger in certain contexts.

>You can’t change people’s minds on emotional baggage like this.

I believe you can. They changed mine.

I think Microsoft is cool now. Certainly much better than Google.

Actually they are probably the coolest if not cooler: https://bgr.com/2015/07/31/windows-10-upgrade-spying-how-to-... even Google doesn't get to track every file you open, which I agree is way less cool. ;)

You don't think google has telemetry on every file you open in google docs? Same problem - different ecosystem. In fact, you literally have to ask google for your file in order to view it in the first place.

Obviously yes, Google is scanning your Gmail emails and doing telemetry on every document you put into their services. That gets a decent amount of attention but it's no where near the amount of information Microsoft gets from you if you happen to be a Windows user. Google's search history on you would pale in comparison in terms of profiling, etc.

That's a pretty awful article from the age of "putting windows 10 and spying in the title generates easy clicks".

The quoted statement had nothing to do with Windows 10 and was specifically do with Microsoft's digital services like Hotmail & OneDrive, which the statement has now been updated to clarify:

"Finally, we will retain, access, transfer, disclose, and preserve personal data, including your content (such as the content of your emails in Outlook.com, or files in private folders on OneDrive), when we have a good faith belief that doing so is necessary to do any of the following:"

Microsoft doesn't care about your local files, but you agree with the generic "to comply with laws and protect our systems" statement if you decide to use their cloud services.

I think I posted that pretty ironically and with enough glib not to be taken too seriously. Oh well. To say their not profiling users using their OS is insane. Private repositories can't even be encrypted on GitHub. What another absolutely insane joke.

VSC has been huge in this regard, too.

I for one appreciate that Microsoft is allowing these dev related acquisitions, such as Github, to maintain an individual brand image. I can't think of anything worst if they decided to reskin/theme these brands to be all Microsoft-y.

> capture a tool/ecosystem that developers liked using and benefit from that positive sentiment

So...appeal to devs, something something, money??

I really like how MS are improving our tools and embracing open source, I really do. But I've never quite understood how the return on investment in these things justify the cost. I just struggle to the an obv big picture here.

I.e. is it incorrect to think of the GH acquisition as mostly an azure marketing expense?

I think being deeply reviled by a huge portion of the developer community has been costing MS huge amounts money for a long time.

I have a limited understanding of this but I think the goal is to have a complete developer ecosystem. When most software was deployed to Windows desktops, they owned the developer environment - Visual Studio.

Now most software is written and deployed on the cloud, but not their cloud. But they could make the dev experience compelling and easy - write your code in VS Code, which automaticallgy integrates with Github. Github is mostly free until you're a large company so why not use it. Of course you need to run CI and Github makes that easy so go ahead and add a single file to configure that.

Now you have a build artifact ready to deploy on github. Would you like to click a single button and have that deployed to Azure? They'll also throw in monitoring if you do it. Azure bills is the pot of gold at the end of the developer experience rainbow.

But this is just speculation. I don't understand business very well.

>I once saw some Microsoft guys demo something cool at a conference, and they had to basically apologize that they were from Microsoft

Microsoft, "the people" were never bad. They did a lot of cool things, they had great coders and scientists. The upper management did bad things, and made poor decisions, guys like Ballmer and business strategists.

With the new management things changed a lot and I hope Microsoft will keep up at doing good things.

Not all things are rosy: desktop development with MS tools suck, they changed framework after framework, Windows Forms and WPF aren't cross platform, C++ desktop programming is still Windows only, and not Visual at all. I don't get why the naming: "Visual C++" since QT or C+= Builder are much more "Visual" than MFC and Winapi.

But I guess desktop doesn't bring MS too much money so they don't care enough about it. If that's the case, I don't get why they don't promote and support a third party, cross platform development framework like Uno or Avalonia.

They can, and will have to continue to, thank MS legal for that bad rep..

While Upper Management has lessened some of their excesses, they still tend to be very aggressive in some area's, and time will tell which 1/2 of the company will win. The Open Collaboration group, or the "We want to control the world" group, there is still an internal struggle there

Many believe the "We love Open Collaboration" is just a facade and the "real Microsoft" will revel itself in a few years

Which initiatives have they led? Which cool products have they invented? What do they do that isn't derivative?

I agree with this take. I'm primarily JavaScript/TypeScript developer, doing both front end and back end web app development. Microsoft being a good steward of TypeScript (and now the js ecosystem) inclines me to give C# and .NET Core a shot, and probably Azure down the line.

Control.

Getting to decide what goes into npm (the client tool) and what does not allows them to focus the ecosystem onto brands that they own and encourages people to buy their proprietary software and services.

It also provides them the option of cutting off third-party tools (e.g. yarn) in the future if they deem it beneficial.

My prediction is that they will prioritize the platform features that can only be accessed by first-party, branded tools, like the forthcoming GitHub mobile app. Eventually they will stop maintaining support for the APIs that the other tools use, and it'll be Microsoft tools from end-to-end. Pushing to GitHub and publishing to NPM from right within VS Code, et c.

Of course, using them on Windows will always work best, and deploying to Azure will always be easiest.

I’m less pessimistic. Microsoft has engineers with a business mindset in charge. For now, it’s true. But we saw node vs IO.js — Microsoft can’t afford a fork or they lose their own control. They won’t close open source, they’ll add subscription or cloud usage fees for large enterprises. The value, like GNU “open core” is that open is popular, while enterprise features on the other hand are expensive. The enterprise is being led now by open source because it’s cheap, then value add to solve the problems they still have around control and oversight, etc.

If anything, I expect basic Visual Studio internals will eventually get open sourced as cheaper to maintain that way than Roslyn rebuild-all-the-things. And VS Code will adopt them and continue to cannibalize VS mindshare.

The first word that came to mind was "integration", but I suppose "control" is another way of putting it.

I doubt Microsoft would intentionally degrade developer experience, like "cutting off third-party tools". Rather, they're seeking to gain market advantage from the tight integration of services. It would make sense for them to encourage third-party tools to play well in that "Microsoft ecosystem".

> Pushing to GitHub and publishing to NPM from right within VS Code

That's exactly what I picture coming soon, if not here already. Also: develop in VS Code, click to build, push to GitHub, deploy to Azure.

It's worth noting that TypeScript is a Microsoft product. As TypeScript has become increasingly popular, I'd imagine that Microsoft has also paid increasing amounts of attention to the JavaScript ecosystem.

Yup. There’s a great memo from 1995 describing the web as the next big platform: http://pstella.com/reading/THEWEB.pdf

Looking at the massive growth in frontend technologies within the last decade, it’s easy to see why Microsoft wants to be a little ahead of the curve this time.

There was a time in the past when Microsoft was ahead of the curve too; they were the ones who invented XmlHttpRequest back in the day.

It's all about securing the software supply chain. Mark Russinovich had a keynote on the general topic at RSA 2020, especially the section on package managers from 0:29 onwards: https://www.rsaconference.com/industry-topics/presentation/c...

Ironic really given that Microsoft has the most notoriously insecure products I can think of.

Can anyone point to a technology company that has a larger attack surface or a more fundamentally insecure product?

Synergy. End to end tracing of dependencies. Licensing mirrors subsets to on premise clients. Single point of flow for code to published package. There’s plenty of places to extend money they’re making elsewhere.

Lowering the entry barrier for JS developers increases the plausible TAM if you make money from downstream developer tools/services, described as 'commoditizing your complement`. (ref https://www.joelonsoftware.com/2002/06/12/strategy-letter-v/)

They get developer mind share and goodwill. That means Microsoft selling more of its services to companies.

The old model of business was like selling pies to dad. Dad might buy or not. Now, you give a free candy to the kid, and dad will buy the pie, too. :)

spooky music

Maybe to be able to be "legally compelled" to distribute backdoors onto linux servers / developer machines running npm in exchange for being awarded the JEDI contract.

I'm sure the prism/NSA angle is still in play, how easy is it to compromise millions of projects in production owning both github and npm?

They want to buy a community of developers.

Think webassembly, not node.

Reply on news.ycombinator.com