Hacker News Reader

Comment by sascha_sl | Hacker News Reader

Are you going to get upset at node for calling home to Microsoft (npm owned by github owned by microsoft) when using the supplied package management too?

View on HN

If you're pulling down a packge with npm that isn't part of the npm registry, the request isn't going through a Microsoft proxy.

Same for Go, only thsy Go has an opt-out "registry" rather than opt-in.

I mean, I strongly just feel the npm ecosystem is a dumpster fire of sadness. Though there is a fundamental difference in that if you use NPM, you are choosing to download packages from NPM. But if you specify a bunch of repos you want to download Go packages from, and you get them from Google anyways, that's pretty uncomfortable. Especially if Google is in turn also DDoSing the repos in return.

No I did not "choose to download packages from NPM". Choosing means there is an alternative. And besides that the registry part is invisible in your package file (hardcoded default like GOPROXY).

If you look at it, it's pretty similar. The part before the first slash is invisible:

npmjs.com/org/package

proxy.golang.org/org.com/package

The difference with Go is that you can actually change the first part if you want, or even disable it.

How could node not do that? NPM hosts all the packages so of course it does.

They could do it similar to Go. Instead of "facebook/react" it could be "facebook.com/react" in "package.json".

Well yes, but my point here is that NPM's entire design is around not doing that - whereas Go's design isn't

IPFS/bittorrent for P2P

Yes. I find all of the modern "always connected, always call home" behaviors quite annoying in my programming tools.

But, to be fair, Node was a dumpster fire long before being bought by Microsoft.

The problems with npm are completely orthogonal to what the author is describing here.

I mean, yes, it would be valid to complain about that as well

Reply on news.ycombinator.com