NPM Is Joining GitHub
github.blog
github.blog
Microsoft doesn’t do everything right but the GitHub acquisition has honestly gone better than I ever expected. Rather than forcing GitHub to adopt Microsoft centric policies, Microsoft has adopted more GitHub stuff, especially from a product POV. GitHub still runs as a separate company (different logins and health care and hiring systems) with its own policies and point of view.
The reality is npm was in a bad place and in a land of not good options, this strikes me as the best possibility. I’d rather have GitHub control this and be able to give the resources to npm than a company like Oracle or Amazon or even Google or Facebook to own it. In a perfect world, some independent entity could fund npm out of gratitude but at the same time, consider how poorly npm as a company was run for YEARS and the general lack of direction.
So yeah, I’m cautiously optimistic this won’t be fucked up by GitHub — but I understand the concern.
As for those worried about Microsoft embracing, extending, and extinguishing. Lol. Even if that was the goal (and I truly don’t think that’s the ethos at all any more), Microsoft is laughably incompetent at achieving that sort of strategy. Google and Amazon have the EEE under lock right now (Facebook too — let’s be glad Zuck didn’t buy this after we saw what happened to yarn), but Microsoft can’t even put coherent dev strategy outside of .NET on Azure.
I missed something, what happened to Yarn?
This seems to be pretty fair about the whole thing: https://shift.infinite.red/yarn-1-vs-yarn-2-vs-npm-a69ccf022...
https://yarnpkg.com/advanced/qa#is-yarn-operated-by-facebook
IMO its crazy we're here, growing up in the IE days, but Microsoft acquiring influence over the JS ecosystem in this day and age is at least arguably, as OP stated, a distribution of power.
Support is middling, but once you get it working, you have near-instance near-zero size installs.
what is EEE?
> "Embrace, extend, and extinguish" (EEE), also known as "embrace, extend, and exterminate",is a phrase that the U.S. Department of Justice found was used internally by Microsoft to describe its strategy for entering product categories involving widely used standards, extending those standards with proprietary capabilities, and then using those differences in order to strongly disadvantage its competitors.
https://en.wikipedia.org/wiki/Embrace,_extend,_and_extinguis...
https://en.wikipedia.org/wiki/Embrace,_extend,_and_extinguis...
.NET Core was a great move and it's all coming together nicely now, and even creating innovations like Blazor.
> Microsoft can’t even put coherent dev strategy outside of .NET on Azure
They said that .NET and Azure, two separate things, are very well managed. OP did not imply any correlation between the two of them.
Free in "freedom of speech" is the ability to say anything you want.
Your choice of free means cost.
So you're free to speak, but the speech itself isn't free.
Freedom of speech is by definition exactly this: free of consequences.
Right. It’s freedom of consequences from a specific entity, the government, not freedom from consequences in general.
Re 2: No. It's just the usual implementation.
So by your definition freedom of speech cannot exist, or you need to refine your meaning of "concequences". That refined meaning is accepted as conceqences from the government.
Any other meaning is senseless because people are free agents and may respond to your speech in any way they feel fit.
Your employer or society in general absolutely can via the consequences of what you say. If you are making your employer look bad then they can and should be able to get rid of you.
If society decides they don't like you because of what you say and choose not to associate with you or use your business than that also feels fair enough.
[0] https://github.com/atom-archive/xray
[1] They never officially announced it, but they almost certainly de-staffed it to the point where it's barely on life support: https://imgur.com/a/jQBHsUk
[2] https://www.reddit.com/r/AMA/comments/8pc8mf/im_nat_friedman...
Update:
What a surprise, the VSCode fanboys are coming in droves to downvote and say nothing more than how Atom was going to die anyways.
Sure, maybe it was, but that's not the point. The point is Microsoft _actively pulled development resources away from Atom after explicitly claiming they wouldn't_.
I get that a lot of people like VSCode better than Atom, but _please_ put things into perspective for a moment and consider if you'd make the same comment if the same thing happened to _your pet project that happened to be #2 in popularity but then got axed after being acquired by the company who owned the #1 after claiming they wouldn't do exactly that_.
Whatever your opinion might be on Atom vs VSCode, can we not at least agree that this kind of behavior is something we should hold acquiring companies accountable for? It might not make any difference to their bottom line at the end of the day, but the least we should do is hold them to the fire in the court of public opinion.
If commit activity graphs are really a meaningful measure, look at VSCode's:
https://github.com/microsoft/vscode/graphs/commit-activity
The number of commits per, uh, date unit (the graph is not super clear on that axis, honestly) across the entire length of VSCode's activity graph rarely drops as low as the highest number of commits per date unit for Atom.
I'd have preferred to see both survive and do well, but that really hasn't been the way the text editor space seems to have worked. Editors that are conceptually awfully similar to one another tend to have one dominant player: TextMate (at least for Macs), then Sublime Text, then Atom, then very quickly Code. Given that Code and Atom are probably the closest of any two in that list, this just isn't that surprising.
Atom still had a healthy number of active contributors (presumably most of them were from GitHub) making improvements to the product on a daily basis to make it a perfectly viable tool for the people who chose to use it (and despite the much smaller developer base they continued to innovate with projects like xray and tree-sitter)... That is until the Microsoft acquisition happened.
Before anyone jumps in with the causation vs correlation argument, I think any reasonable person looking at the evidence would agree that the timing is convenient enough to make it highly unlikely to have been a coincidence, especially considering that most of those contributions were from employees at GitHub who were _getting paid to work on Atom_, so the only reasonable explanation for the contributions to stop abruptly within a month is that they _stopped getting paid to work on Atom_.
To add insult to injury they even had the audacity to claim they wouldn't do exactly what they did. That is the crux of my issue with how they handled this acquisition.
It's quite possible that this was just a random side-effect from a shift in focus, instead of a planned sabotage.
But the words of the linked Reddit comment from Nat Friedman were "we will continue to develop and support both Atom and VS Code going forward"; that's a true statement today. Atom is currently being developed and supported. That's a case of adhering to the letter of the statement rather than the spirit, I know. But that circles around to the problem of VSCode's rapid ascent in mindshare -- if your company ends up owning two very similar editors and they both have roughly equal downloads and community interest, you might try to support both equally. But if one of them has orders of magnitude more downloads and community interest than the other, you're going to focus your efforts on the popular one.
What need does Atom fill that VSCode doesn't?
Lack of delivery killed Atom, not Microsoft.
I was an user of Atom and later switched to VSCode. It took me few months of weighting all the options before I made the switch. That's how much I love Microsoft -- Very little.
Don't know if they got it fixed, but there was a design flaw in Atom: Bug inside some Atom plugin (`linter-ui-default` is one of it if my memory is correct) can reset the entire Atom into it's default setting, and it happens randomly (See link 1, 2 and 3).
This problem pisses me off so much and so many times. The last time it happened, I accidentally deleted my backup configuration `config.cson` when trying to recover the setting. Yes, it is technically my fault, but no, really, it is not. So, after seeing all my life flashed before my eyes, I decided to stop living ... with Atom, I had enough.
VSCode is generally a better editor when compare to Atom. I mean, VSCode has it own issues, sure. But for me, so far those issues are mild and usually got fixed quickly.
1: https://github.com/atom/atom/issues/14922 2: https://github.com/atom/atom/issues/14909 3: https://discuss.atom.io/t/atom-keeps-losing-settings/61617 (This one was in 2018 while the other two was in 2017)
It's possible that one of the linter providers had that issue, and since Linter providers are only called by the linter package, they wouldn't exhibit the issue on their own. It's not uncommon to have issues that seem like it's the linter's fault since all of the providers do nothing and seem harmless unless invoked by the linter package.
I would've helped to debug this, had somebody pinged me on any of the issues. Oh well :)
So maybe it's not a bug of `linter-ui-default` after all. Sorry dear innocent man, my judgement is not always on point :)
I don't think so. When VS Code came out my reaction was "Wow! It's like a 1.0 version of Atom!" I.e. an electron (or similar) based editor that works, whereas atom always seemed like a beta release. I tried to use atom a bit but it came with little out of the box and the plugin ecosystem was a complete mess. I filed an issue asking if obsolete/dead plugins could be somehow removed from the plugin repository, but nothing came of it.
Atom wasn't killed, it died on its own.
That's what we said about the Skype acquisition too.
"It's different this time, it will run independently, for once Microsoft won't interfere and destroy the acquired company".
3 years later (I was there), 50% of Skype original management and developers left. All the major new projects of Skype turn out to be integration with the endless already existing Microsoft products: integration with Link, integration with microsoft ID, integration with Microsoft UI, etc...
5 years later, Skype is dead... but everyone left already.
Good job Microsoft.
“On 10 May 2011, Microsoft Corporation acquired Skype Communications, S. à r.l for US$8.5 billion”
I think Microsoft has changed significantly in the last decade.
I’m quietly hopeful the npm acquisition will go well for us (although I still hold some serious grudges about Microsoft’s past behaviour).
Thats not the important thing, thats the problem. Npm could easily be an open source client. Contain less code and be better. And have a mirors system like every other repo so it does not need money for hosting.
Npm wanted to control nodejs and make money out it. And they have.
Microsoft purchased that control and plan to make money out of it.
This is bad news for OS dev.
What does this even mean?
No interest in mirrors from day one.
Npm sold out to Microsoft and got paid. All that free community effort to stop Npms "crashiness" got sold to Microsoft for dollar.
Nodejs went to the Linux foundation.
Npm went to Microsoft.
Suprised?
You said they controlled nodejs, and that they somehow earned money by controlling nodejs. I think that neither of those has ever been the case.
The NPM client is and has always been open source: https://github.com/npm/cli.
> Npm wanted to control nodejs and make money out it. And they have.
In what way, other than offering private package hosting for enterprises?
You have to understand that the technology underlying Skype at the time was very brittle and poorly designed.
Google almost bought Skype before Microsoft did and backed out after they got a look at the code.
When Microsoft acquired it Skype was routing its traffic over port 80 for example.
Put another way, if both sides block 80 incoming, their only hope is fancy NAT-punching techniques.
But those NAT-punching tricks are useless if they are using a port that is completely blocked on the outbound side.
__I have to understand__ ?
Who is saying this? do you have any credentials / knowledge of Skype technology? My understanding is that you only report indirect discussion from "your friends who worked on it"?
Having been there, I would say quite the opposite.
Skype had pretty intricate means to bypass NAT to NAT clients. I would even go as far as saying that Skype P2P connectivity tricks were top notch, considering the incredible amount of different network setups that clients could face. Even in the weirdest conditions, you could trust your Skype client to somehow find a way to get the call through. This was through an immense collection of in-house-trial-and-error-STUN-hole-punching like techniques.
Now I can understand that for people outside of the peer to peer connectivity world, these techniques could seem completely foreign and brittle, but it's not. It's the world of internet clients we live in. It's not related to Skype, it's the route all peer to peer clients have to deal with. If you don't want that, don't go peer to peer.
> Google almost bought Skype before Microsoft did and backed out after they got a look at the code.
Where did you get that information? I had never heard of that interpretation of the story before.
My view on this is that Google considered buying Skype, but backed up because they wanted to have a cloud based service, instead of a p2p one. Microsoft was in the same state of mind, but decided to go along and migrate Skype to be a cloud service, which they did.
Now if you really want to discuss technical details and the state of Microsoft/Azure at that time, I would be pleased to do so.
Microsoft started the migration of Skype to the cloud at a time Azure was just a big beta test. Nothing was working properly, the tools were sub-par or in-existent. Nothing was reliable. You would deploy Azure services through remote desktop automated by PowerShell scripts. Managing databases was done through in-browser silverlight clients - yes, that was already EOL at the time, but that was the only way to perform DB queries with a UI.
When complaining about the deplorable half-baked status of the tooling and cloud services that we were required to use to migrate Skype, the only response was "Yeahhh, Eat your own dog food".
Thanks but no thanks.
All the great Skype engineers left in the two years after the start of the migration to Azure - mostly to join Twilio.
https://www.google.com/amp/s/www.wired.com/2011/05/why-googl...
Key points:
He did not think Skypes p2p communication was a good fit for Google, going so far as to say it ate up bandwidth and was like an old technology.
The PM's remarks could be summarized as saying the basic p2p communication architecture was overly and only used in order to avoid a cloud/server based architecture.
Basically, the PM thought Skypes architecture and code base couldn't effectively scale or meet real world business requirements that people would pay for.
Like VCs who try to invest in a company but lose the deal (or never get to see it at all): "Oh FooBbarApp? Yeah, we passed"
Seriously, go use products like Google Hangouts, Slack or Microsoft Teams (Microsofts's surprisingly better clone of Slack) and then tell me that Skype was ruined by integrating with Microsoft's other product base. The closest argument you might be able to make is that Skype could have developed new features or updated its UI and stayed competitive, but that wouldn't give them the competitive edge that it's competitors nearly all had in terms of being backed by major tech companies. Additionally, the major revenue source was Business tier use, which Microsoft dramatically improved by integrating it with their other cloud-based business suite applications.
Microsoft didn't kill Skype, if anything they extended its life expectancy and value in markets that actually paid to use it. It's dead/dying now because better tools have been developed and marketed to replace it. That's just standard product life cycle.
Personal experience, but I have not found a single person who likes MS Teams. Usually people around me say that Slack is ok-ish, while MS Teams is crap.
I've the misfortune of being forced to use Skype and I would kill to have it replaced with Teams at my workplace.
There is a half-baked link between Skype and Lync to make it seem like it's the same product. This link is all shitty mainly because Lync and Skype work completely differently, and even simple things like call signaling have to deal with years of legacy Microsoft SIP extensions that were punched into Lync.
I remember the first time we received access to the Lync code repository. That stuff was a multi-GB (!!!) repository that contained files, promo videos, PDFs, code, etc. That tells you much about the development practices behind Lync.
It's not great, but in the corporate space, Teams does an OK job, and MS is a reputable company for B2B.
Corporate standard at my place of work. I hate Hangouts with a passion. It's the worst messenger, feature- and UI- wise that I've seen for years.
> Microsoft Teams (Microsofts's surprisingly better clone of Slack)
No it isn't. Used Teams at another company which adopted it as the standard. Couple of years ago. Feature-wise it was like a proof of concept, very early access.
> Additionally, the major revenue source was Business tier use, which Microsoft dramatically improved by integrating it with their other cloud-based business suite applications.
Again, I worked at another company where Skype for Business was the standard and nobody ever used it unless they needed formal IT help or something.
All the teams I'm acquainted with at my current place refuse to communicate on Hangouts and, in violation of corporate policies use something else like Slack or Mattermost.
The initial capabilities look similar and circle really needs a competitor with how flaky their service has recently been.
For someone who's not a pro in using CIs, it's been much easier to use than CircleCI. I never have to spend more than 20 or 30 minutes fiddling with Actions to make it actually work.
This for me is the biggest contribution to open source: normal people like me (who don't want to get too familiar with proprietary or overengineered CI tech) will be able to have CIs for pretty much ALL their projects.
If they did choose to EEE, this makes it more likely, not less.
What happened with yarn? As a very casual user of it, it seems to work well and have pushed npm to innovate a bit when it was stagnating. But I haven’t followed it lately. Were there technical issues or political drama?
I mean, zip files are hardly complex. PnP is a breath of fresh air and lets you commit packages "safely" to your SCM without LFS. NPM has been experimenting in v7 with similar ideas.
I'm personally quite fond of "zero-install" setup to a repo.
But, you know, we've had decades of companies whose 'business model' is just their exit strategy...
npm i some-package username/repo#branchName
npm install username/repo#semver:^1.2.3
JavaScript is an interpreted language -- as long as you're only downloading source code from the registry there's really no reason to use a registry instead of the plain old Git repository.
With NPM acquired by GitHub, I can imagine them "filling in some steps" by leveraging the fairly new Actions feature, so that repos can provide built artifacts, the same ones as published on NPM. The deeper integration will be an interesting development to watch.
And we're yet to hear of any negative impact of their Github acquisition (afaik - correct me if wrong).
What you are talking about is Right-wing politics, even if they are extremely far to the left of your -and the majority of peoples political view -in the USA. Both parties in the US are on the right. This isn't Reddit where the state of US politics is the default norm when it differs from most of planet earth. Though HN is quickly getting there.
ICE are the goons operating everywhere (i. e. not tied to the border) rounding up "suspected illegal immigrants".
Because it isn't exactly hard to find illegal immigrants, and their charter allows them to control people without objective cause, ICE gets to arbitrarily decide whom to harass.
It's the real-life version of the perennial fear of civil libertarians that too many criminal laws will just lead to any one of us being arrested whenever it happens to be convenient for whoever is currently in power.
It isn't going to end illegal immigration, nor curtail it to any significant degree. It just serves to keep a large segment of the people who see every day in a constant state of fear, unable to (for example) seek protection from crime or exploitation for fear of being deported.
As for the rest of your comment, this is the far-left extremist position that I cited in my first post. There's no good faith discussion to be had here.
No, it's the enforcement arm for immigration and customs, the former of which is people who are living in the US despite not being US citizens. Enforcement of people (and goods) crossing the border is the Border Patrol and it's parent organization Customs and Border Protection.
There's not much controversy over the people who cross illegally but stay temporarily and close to the border. Those are just traffickers and cartels.
https://www.aclu.org/issues/immigrants-rights/ice-and-border...
Also detainment centers are not cages but fenced areas with free movement inside where people receive food, shelter, healthcare, entertainment, schooling and legal services paid for by US taxpayers while their cases are processed. Detainees are free to deport themselves at any time. This is more accommodating than pretty much every other developed nation.
These are well-documented facts that have been widely reported on in the mass media. You can find links to specific articles on my blog in the recent article about Microsoft and GitHub, if you wish to learn specifics.
The kids are in there right now, as I write to you.
Whether or not Microsoft's provisioning of services to the government is "legal" or not is not particularly relevant to the thread, but it is interesting that you bring it up, presumably as a defense of their behavior.
Again: This is not a partisan thing. At all. Your attempt to reduce it to such is inaccurate (and, tbqf, off-topic for the thread about Microsoft-the-corporation, as well as off-topic for HN).
I'm a naturalized immigrant. I've been in far worse places than America. I suggest you visit CBP and ICE. Talk to the agents. Visit the border. See the shelters. View the damage done by criminals who prey on these people and find out how much the agents do to help them while risking their lives fighting cartels and traffickers.
Like I said, America is far softer with borders than other nations. Crossing illegally brings enforcement and penalties. I'm not sure why this is so controversial, or why protest against govt organizations is done by proxy of software companies.
The fact that it is open source and popular is not sufficient on its own. It had to be forked (vscodium) to show basic respect for the user’s privacy and system resources.
So it "furthers my intended point".
It’s builds released by Microsoft that have all of their specific stuff added in.
> This is not a fork. This is a repository of scripts to automatically build Microsoft's `vscode` repository into freely-licensed binaries with a community-driven default configuration.
This is such an extreme & pretentious viewpoint. Microsoft knowing that I have VS Code installed & getting a report when it crashes is not in mine, or really any normal developer's threat landscape.
Those are great until they're not. It's why it's called "bait and switch".
> And we're yet to hear of any negative impact of their Github acquisition (afaik - correct me if wrong).
ANY?! Heh, do a quick search just on HN and you'll find it pretty quickly.
https://news.ycombinator.com/item?id=17221640
https://news.ycombinator.com/item?id=17221656
> I'm legitimately curious as my use of GitHub hasn't led me to notice any change
Nor I. That's not that point.
For the record, I think Microsoft has done wonderfully for the dev community in the last 10 years. I don't see any reason that they are going to "f it up", but big businesses get desperate when environments change and profits get impacted (look no further than what Oracle is doing). Microsoft is not immune to that.
Next you'll call them Micro$oft. Come on now.
If it does micro$oft will just buy the world out from under them.
I understand the concern about MS business practices, but I don't think it applies to environment where transactions (as in, importing someone's package or submitting a pull request to it) don't involve any contracts or money.
Assume the best all you like. Microsoft are spying on you and can lock you out of their ecosystem for any reason. When that ecosystem includes critical public infrastructure, there is a problem.
The only "sane" response to this is to smile at the MS employees who tell you how much they love Open Source and to use absolutely any other platform.
For some examples: RMS being a douchebag has nothing to do with the usefulness of gdb, nor can that circumstance affect the utility in any imaginable scenario.
Microsoft setting censorship policies (aka ToS) on a website they own and control directly affects the utility of npm/yarn/clients. Their website, their rules.
https://sneak.berlin/20200307/the-case-against-microsoft-and...
VS Code has had to fork to remove the unethical spyware portions within it placed there by Microsoft:
I realize this is just pure anecdata and not a legitimately researched observation, but I don't know a single dev in real life who either switched away from Github or VSCode due to those concerns, despite having a wide variety of dev friends from all kinds of backgrounds, including big tech devs, non-tech company devs, fully remote devs, self-taught devs, small startup devs, outside of the US devs, freelancer devs, etc.
"When we [Microsoft] build Visual Studio Code, we do exactly this. We clone the vscode repository, we lay down a customized product.json that has Microsoft specific functionality (telemetry, gallery, logo, etc.), and then produce a build that we release under our license."
"When you clone and build from the vscode repo, none of these endpoints are configured in the default product.json. Therefore, you generate a "clean" build, without the Microsoft customizations, which is by default licensed under the MIT license"
When a certain build configuration enables major spyware features, and that is the build configuration for the released version by the first party, and another build configuration (that is not released by the first party) disables those major spyware features, the distinction between a fork/patch and a "different build configuration" becomes semantically meaningless.
It's a fork, regardless of how they care to present it. The result of the build configuration is embedded in the release. Consider it a "binary fork" if you don't like considering json "source code".
The acquisition can be a good outcome for the current situation without it being the ideal state of things.
Would yo prefer npm infrastructure to be maintained and developed by the lowest-paid programmers they could hire?
Linux repos take the alternative approach to try to get as many mirrors as possible so it can remain free.
Microsoft did not buy npm to help it become free. Believe. They bought it because they rekon they can make buck out of it.
That buck comes from somewhere.
Nodejs going to the Linux foundation was good news.
Microsoft buying Npm is bad news.
Ruby Gems, PHP composer, PIP, etc. would all like a word with you....
I don’t know, so I have to ask, what’s the metric here?
As at Oct. 2018, the top 12 npm packages [1] were already doing more than 0.5 billion downloads a month. Granted, popularity has waned for a few of those top packages due to deprecation or new language features, for instance.
EDIT:
NPM’s announcement about the acquisition [2] provides up-to-date numbers:
“Today, npm serves over 1.3 million packages to roughly 12 million developers, who download these things 75 billion times a month ...”
1: https://news.ycombinator.com/item?id=18343604
2: http://blog.npmjs.org/post/612764866888007680/next-phase-mon...
The fact that there's a bunch of critical infra run on a precarious volunteer shoestring is not a good thing.
It probably isn't going to 20x VC money, but it sounds like it would be profitable to run as a business.
"2fa" sounds bad. That is clearly marketing bs for linking your npm account to a MS account with more personal info attached.
Ease of publishing will be the first thing to go.
Then the fun will disappear with MS as owner, like when Oracle bought Java.
Happy to be a rustacean.
And they will ask you, under the guise of 2fa, to confirm thier suspicions.
And $7 a month gets plently of new upgrade options offered.
All talk of mirrors gets brushed under the carpet.
Microsoft pwn all nodejs code except core and those savvy enough to spot this coming and distribute via debian repos.
I'm not sure that's an improvement in any way whatsoever.
what does that mean? That Microsoft works for the NSA or something?
MS? Not even a chance. What percent do you think of their business is actually government, beyond buying licenses just like nearly every other corporation on the planet.
Why I think this: private or volunteer models are unsustainable in the long run owing to funding uncertainties or conflicts of interest between stakeholders. Utilities that support the bulk of our technical infrastructure should be secured by public interests. Governments can keep things free.
Common objections:
- "Governments are inefficient". Depends on the area. The government tends to be inefficient in handling areas with direct consumer benefit, but less so in dealing with consortiums or private entities. Since private entities are the primary mainstream users of packages, I don't think government will be too slow on this front.
- "Governments will be malicious". This I don't doubt, but the solution for that is building better trust mechanisms rather than keeping a practical solution at bay, and for software at least such trust mechanisms are tenable e.g. see the CNCF's Falcon project.
That would work for Npm. Npm has enough problems that its worth running your own mirror for business continuity.
Microsoft are likely to make breaking changes immediatly.
And risk-averse businesses do already.
Microsoft and their allies make the world a lot worse for a lot of people. They’re the number one distributor of spyware in the world!
That's generally not a good place to be.
'small business' is only the equilibrium in sectors that can't increase aggregate output by growing or capital investment like say, the restaurant industry.
Why does NPM need to be funded as a commercial entity at all? What other open source library has a private company running its package manager? This one still boggles my mind.
- the Java/Kotlin/Scala ecosystem is based around maven central, which is run by Sonatype, Inc.
- Go modules are hosted by Google. Previously, most libraries were hosted on Github
- Rust's crate index is on Github
- The Docker/Moby registry is run by Docker, Inc. (though that might be a stretch for "package manager" :))Some libraries aren't hosted on Maven Central actually, so it's not uncommon to see instructions for adding extra resolvers to your build config.
The Java ecosystem isn't as dependent on Maven Central as the JavaScript ecosystem is on npmjs.com
If MC goes away as it exists today, the Java Ecosystem will take a huge hit as almost every open source project would stop building in CICD environments from the get-go.
Note that the crates.io index is just a single git repo that holds JSON metadata about each crate: https://github.com/rust-lang/crates.io-index . The actual code found on crates.io is hosted on S3. The index is an important part of the system, but there's nothing tying it to Github specifically.
Not sure how APT works in the linux community can really work for anyone else, but definitely worth a shot for sure.
Not many non-commercial entities can afford that.
- Microsoft is a leading sponsor of open source?
- In fact, .NET is open source now and runs on Linux?
- Microsoft bought Github, then NPM... and the community is celebrating both of those things??
- The guy from the apprentice is what?
I don't think you could honestly say the community celebrated both of those things.
Regarding "trace a change from a GitHub pull request to the npm package version that fixed it" will there be an API to add a source in case the change was made outside of GitHub? Although I recognize that the vast majority of changes to npm packages happen on GitHub.
But I could have this not right?
It has been confusing for a variety of reasons.
And I think there are mixed reviews with how well it's going overall, especially the RubyTogether part.
We think Git(Lab|Hub) will become the two most popular solutions and we look forward to this competition https://about.gitlab.com/handbook/leadership/biggest-risks/#...
I think the companies that should be nervous are ones that have only one stage or ones that have multiple stages but as a suite of applications instead of a single application https://about.gitlab.com/handbook/product/single-application... There are a lot of these https://about.gitlab.com/devops-tools/
I wish Gitlab would get over this passive-aggressive negging of GitHub.
I would squirm seeing something like that among any two competing companies. But it takes a strange configuration of overcompensating an inferiority complex to use it for the specific case of one company starting out as an explicit clone of another, to then lord any small feature the original company may have followed over them.
This isn't the first time. I've seen it dozens of times, and I don't even specifically care about these two companies.
Somehow, you took this explanation of why they aren't worried about this and turned it into a passive-aggressive stance..
GitHub is now very much focused on the end to end life cycle now that they have "GitHub One".
And Microsoft doesn't even have to maintain the main runtime, Google does. What a clever strategy!
Someone at MS knows strategic and tactics. When MS and Windows bootstrap themselves into the cloud, they will have some software to land on.
They lost a decade of battles for the web, but it seems they just found a way to get back in the fight.
Now at the IE 6 times, that meant monopoly, and it was terrible news.
But today, it means more competition between the giants, which is very good for us.
It has been argued with various success [1] that Chrome is the new I.E., due to "Chrome exclusive" web standards.
[0]: https://html5test.com/compare/browser/safari-11.2/chrome-30/...
Here is the correct comparison: https://html5test.com/compare/browser/safari-11.2/chrome-68/...
Which clearly shows its the worst of the bunch.
Edit: Also just noticed, the latest Chrome version that the site has is 68. We're currently on 80+
It's a weird world where webdevs apparently ideally just want everyone on the 6 second old version version of Chrome. I totally get it -- it's an absolutely rational stance but it feels a lot like how devs felt about IE6 at the beginning.
Plus because it's tied to the OS and the phone determines the maximum OS you end up with a bunch of users stuck on ancient and buggy versions.
This is to say nothing about the remote debugger purposefully locking you out of older versions for no reason to make debugging them harder.
A webview in iOS could sometimes crash system wide. Not enough to restart the app. You'd have to restart the device.
Felt like a sitcom when I had to ask customers if they'd tried turning it off and on again.
It's not even required or the default install on any OS. And it has rapid updates that constantly test new features and improve performance and security.
Any "exclusive" features are just early testing for later standardization. It's Safari that's lagging in implementing them.
The problem is that it was left to stagnate after Microsoft won.
[2] example import in Deno:
import { serve } from "https://deno.land/std@v0.36.0/http/server.ts";
Who is backing the project in this point?
I wonder to what extent they've had influence over their own success at all though. Basically they had to hope that JS stayed popular (it did), that Node stayed relevant (it did) and that the entire JS ecosystem would move over to NPM (it did, but I'd say rather despite NPM than because of it) (I mean, otherwise Yarn wouldn't even exist, right?).
So basically their bet was:
- Turn NPM into a startup
- Keep the lights on
I bet I'm missing all kinds of key behind-the-scenes stuff, but still, I don't know many startups that manange to successfully exit by "just" keeping the lights on. In a weird cringey way, it's motivating.
Keeping the lights on long enough makes this kind of exit more likely. Paul Graham has a good article about this: http://www.paulgraham.com/die.html
NPM did better than "just" keeping the lights on, though. They even held Yarn at bay by adopting its best features very quickly.
"I have a set of goals that I wrote down back then, and have shared openly with the team.
...
3. Get a big enough exit that I can quit my job and see what comes out of me a second time. 4. Share the rewards equitably with the people who got npm to where it is.
...
On (3), well, I’m still working a jobby job, but I always knew that was a long shot, and “make npm a better package manager” is a job I enjoy. And as for (4), I’m proud of the deals that we’ve been able to negotiate for the team.
It’s not a kajillion billion dollar 10x startup cinderella story, and we’ve taken our hits, but in the end we’ve done right by our community, team, and careers, and I’m extremely proud of what we’ve achieved."
I would expect that there was at least a mention, considering the reason that most modules in npm are still in ES5 is exactly because of the monopolistic practices that Microsoft followed back in the day which makes Internet Explorer still relevant.
Not negative, not positive comment. Just surprising there was no mention. And I do think Microsoft is doing a great job recently with Open Source in general.
[1] https://blog.npmjs.org/post/612764866888007680/next-phase-mo...
Reason one is because Linux is GPL'd, Microsoft can't extend Linux without giving its extensions back to the community.
Reason two is because Linux is already established in multiple realms, so Microsoft can't bully its way into dominance. Microsoft has a respectable presence in server rooms, but it isn't absolutely dominant by a long shot. Microsoft probably has something going on in the embedded/hobbyist SBC space, but there's no path for them to dominate there. And, FWIW, Linux owns the supercomputer world. I also can't see IBM falling over itself to put Windows on mainframes.
Microsoft doesn't want to be Microsoft anymore; it wants to be Oracle and IBM and primarily make money off of business consulting and the cloud.
I think Windows will eventually become a presentation and slowly-phased-out compatibility layer on top of Linux, similar to the way macOS became Unix, but even less different than its underlying OS.
However, it should be noted that I'm not very good at predicting things.
Wine is 26 years old.
Depends on what you mean by "good enough". Wine is an incredible project that has achieved amazing successes, but it still falls short in a lot of ways.
I personally don't use Wine but I've encountered people online in the last 10+ years that use the argument that it's "good enough" for people to fully switch to Linux. Realistically, I don't think Wine actually convinced more than a handful of users to abandon Windows
I think this is unlikely. In many ways the NT kernel is superior to the Linux kernel. I just wish it were open source and didn't have the rest of windows around it.
The Linux kernel is ubiquitous and free-as-in-beer, so it might win out. Android has already shown how you can build a proprietary userland on top of it.
Good point.
WSL1 was a proprietary reimplementation of the Linux system call ABI as an NT subsystem. WSL2 is actual Linux running in a VM. That seems to be moving in exactly the opposite direction.
EDIT: I'm mostly kidding, but you can't really expect true change of morals when the vast majority of the upper management is the same under the new CEO as under the old one.
That said, I'm thinking Moon Microsystems :-) Not as big or as hot as Sun. (ok that is a bad punalogy) I did get the domain though, it was available and I couldn't resist.
But can you make a cool logo out of "Moon"?
No, but with minor butchery you can re-use the Sun logo with the letters MMS (Moon Micro Systems) :-)
There's something hilariously farcical about holding a grudge toward Microsoft for a quarter of a century.
Ever since I have been able to get the Microsoft out of my systems, I find myself naturally predisposed to keep it out. I am not against Microsoft, I really am a fan of a lot of the open and developer-focused things they are doing, certainly not least of which is their support for Kubernetes through Azure, but this does not make me more receptive to going back to living in a Microsoft OS-flavored ecosystem today, it just is not happening for me and it's nothing to do with holding a grudge or similar.
I use a Mac now because it was provided by work, if they offer me a trade for a Windows machine I would probably consider it because of the progress made by WSL2, but our group policy lags somewhat behind and certainly not on insider ring, so none of my coworkers have been able to try WSL2 on their work-provided Windows machines, or likely will for some time, and that makes me seriously think twice about it.
My natural inclination is that I would much rather install Linux as the host OS so I have control over things like when updates get applied, or whether a reboot needs to take place immediately, in spite of the struggle that sometimes comes with that, it is really much better to have the source and keep the capability to control your own hardware. And then only run Windows in a VM whenever it is really needed. (In other words, to be able to occasionally run Windows apps in a similar way as I do when I have to use them on a Mac.)
Sun’s hardware was expensive although their software was nice. Their handling of Java put me off them and led to this current state with Oracle.
They had many positives, but I’d rather have old Microsoft than old Sun if I had to pick only one to eat everything. Definitely prefer new Microsoft.
I just find it tragic that the only way GitHub could survive (I guess) was to be BOUGHT. Like why couldn't they stay smaller, focus on what they were good at, and standardize with the community all the integrations in an orderly manner?
Although, Microsoft has shown they care more about the developer community than Apple as of late. So for that, I can at least say my trust is rising. But it's a bit too late for me, I'm happily running Linux for most of my daily life.
But apart from the fact that they followed the unfortunate modern trend to add telemetry to things, I can't really say Microsoft has done anything particularly offensive to me in the past... nearly a decade?
Just because you've been a developer for 25 years doesn't mean you should evaluate a company based on 25 year old events.
Furthermore, basically everything Microsoft did that made developers hate them is legal. Why is it okay to hold a grudge for “embrace, extend, extinguish” but not for aiding and abetting an organization that consistently violates our civil liberties?
https://hothardware.com/news/microsoft-changes-offline-accou...
https://www.howtogeek.com/519572/microsoft-is-testing-ads-in...
And that is all recent, on top of all the other stuff they won’t fix, like issues where file extensions magically reset to Windows defaults, nagging you to just please try Edge because its better for real this time, and the unavoidable mandatory Candy Crush - seriously, if you install with no internet connection, it will keep a placeholder there for you that will install as soon as you’re online.
The telemetry issues are annoying too, not because they exist but because you have to read a books worth of literature to understand what they chose to document. Seriously:
https://docs.microsoft.com/en-us/windows/privacy/configure-w...
Windows 10, I wanted to like it but I can hardly tolerate it. Has Microsoft changed? Maybe, but apparently the Windows team didn’t get the memo.
And the Candy Crush thing... like, if it was just Home edition? Fine. If it was even smart enough to realize it need not preinstall that on a domain account (the installation of UWP apps is technically per-user), like, if they'd demonstrated any recognition that Windows is used in professional settings... I'm right there with you on this one.
However...
> like issues where file extensions magically reset to Windows defaults
https://devblogs.microsoft.com/oldnewthing/20190225-00/?p=10... is probably the best response to that. Given the number of Windows app developers who do unholy things with their apps, it's hardly a surprise. (My understanding is Windows has a huge number of secret compatibility shims just to keep major software vendors' bad hacks and API misuses working.)
> nagging you to just please try Edge
I literally can't escape "switch to Chrome" nags, as a Firefox user. Every Google site has at least one, Google's home page has displayed an amazing three Chrome popups at the same time before. I'd maybe give you this one if they weren't waging a war on it to a far more aggressive foe, and losing badly.
edit: So far I’ve tried switching my user agent, turning off adblock, using a private/logged out window, on docs and search. Not that I’m doubting you or anything, but I am surprised I’ve not noticed it much since switching back to Firefox.
It’s also probably worth disclosing that I work for Google, though at home I am using Firefox and Duckduckgo.
Your mileage may vary on any given month, as Google frontend code seems to come and go regularly and randomly, indeed varying by platform, OS, and lunar cycle.
They're made up of many small and hardly interconnected parts.
Whoever made some despicable decisions 25 years ago, almost certainly don't work there anymore.
An oxymoron?
Recently I installed win10 pro and was appalled at the way I had you jump through hoops to NOT have a m$ account, not to mention the blatant adware. And this was win10 professional.
It certainly reminded me that m$ is a long long way away from where it was in the 90s and early naughties.
So, a good start would be a stable and private os without all the adware and telemetry.
PS: I use gitea instead of GitHub these days. Nor do I use vscode, but sublime text, for the same reasons: too much telemetry that cant be disabled permanently.
Microsoft has the Windows Subsystem for Linux, allowing Linux binaries to run on Windows. How about the reverse? Get WINE to the point where Linux (or FreeBSD or some fully source OS) can reliably run Windows binaries.
Along the same line, provide portable libraries to allow other office suites to reliably edit MS Office files (docx, pptx, etc). Maybe Adobe or someone will come up with a commercial competitor, instead of just LibreOffice.
Make Windows and MS Office a choice, rather than a tax businesses have to pay to be compatible with everyone else. That would go a long way to establishing trust.
Windows is like three decades of legacy systems, but I would argue many of Microsoft's recent decisions have been at the cost of their Windows division.
Just like a cancer! Oh wait...
I loved that they explained how the name github came to be in one of the older landing pages.
2020 - https://github.com
2019 - http://web.archive.org/web/20190317031034/https://github.com...
2018 - http://web.archive.org/web/20180317031034/https://github.com...
2017 - http://web.archive.org/web/20170317031034/https://github.com...
2016 - http://web.archive.org/web/20160317164519/https://github.com...
2015 - http://web.archive.org/web/20150317031034/https://github.com...
2012 - http://web.archive.org/web/20120317031034/https://github.com...
2008 - http://web.archive.org/web/20081211021557/http://github.com/
On the other hand, GitHub had a reputation for offering a first class freemium experience and this does chip away at that a bit.
I like that they don't have 30 day retention policy when you want to delete something (repos, account) which is what everyone else does to keep you on the site. Really hate that.
This is independent of what Microsoft's doing with .NET Core. I'm excited about the work that they're doing, but this isn't going to stop us from making sure that npm is outstanding.
Sounds like it won't be shielded from the cult-like MS mentality, then.
Maybe Microsoft's reputation is exactly the reason why it was left out of this announcement.
Sometimes a brand is so tarnished that the owner tries to hide it from the people who hate it. (For example, Comcast → Xfinity. I expect Monsanto to go the same way and become Bayer.)
The same also goes for Charter → Spectrum.
When the company that commercialized heroin and was complicit in the holocaust is a better brand you really got a PR problem.
A decentralized web or a non-for-profit like Wikipedia is a much better model for these infrastructure projects.
Discoverability and pull requests are two big benefits that GitHub has offered. Could we create decentralized open source solutions to provide those benefits? Are there other benefits that we’d need to provide to have viable alternatives to centralization?
Pagure supports submitting pull requests with Git repos on any server (regardless of whether it's running Pagure or not) with its remote pull requests feature. Issues, docs, and pull request metadata are all stored as git repos using JSON files as data, making it easy and portable to other Pagure instances and easy to convert for any other system.
As far as I know, Pagure is now the only Git forge software packaged in all major Linux distributions (Fedora+EPEL[1], openSUSE[2], Mageia[3], Debian[4], Ubuntu[5], Arch Linux AUR[6]).
It'd be nice to see people interested in this helping to build a future supporting portable, decentralized development.
[1]: https://src.fedoraproject.org/rpms/pagure
[2]: https://build.opensuse.org/package/show/openSUSE:Factory/pag...
[3]: http://madb.mageia.org/package/show/name/pagure/release/caul...
[4]: https://packages.debian.org/sid/pagure
Could you tell me more about that?
Why would there be a mention of Microsoft? That many modules in npm are ES5 is completely irrelevant for npm's purpose.
And Microsoft changed, how exactly?
And why are you advertising for them?
https://news.microsoft.com/2018/06/04/microsoft-to-acquire-g...
"Joining" is an interesting term here... but I suppose it won because it sounds more like something friendly humans would do. "NPM Is Breaking Bread and Sharing with Github as Special Friends."
Meanwhile, I almost have my team switched to yarn.
Switching to berry has been a huge PITA over here, but I don't want to give up workspaces
I check yarn about every three months, or when I find a new, infuriating bug with the npm CLI (so, every couple of months on average). I think npm install suffers greatly from not having a formal spec. It has been bugfixed by so many different individuals now that it has reached a truly astounding level of schizophrenia.
If yarn didn't exist, I would have started trying to break down the install problem into many independent concerns that can be reasoned about individually and tried to solicit help in making a full installer out of it. If I'd known I'd still be trying to make yarn workspaces work for us 18 months later I probably would have.
Node modules in general have some bad patterns of delegation that are utterly antagonistic to self-documentation, and both yarn and npm seem to suffer from this as well. I think in the next week or so I'm going to have to set up a small test case that exhibits the yarn bug I'm seeing, or any of the half a dozen interlocking (emphasis on 'lock') npm bugs that now have me painted into a very tiny corner.
npm v7 features a ground-up rewrite of the tree resolution and deification logic in the @npmcli/arborist module. I recommend checking it out, or at least staying tuned for the beta coming soon.
I had still been following 1.x
Looking at https://yarnpkg.com/advanced/migration : T-T
We have so many little modules from different teams, or even borderline abandonware, that it would take ages to make these changes, and 'yarn node'?? Just... no. How is that ever gonna work consistently with node_modules/.bin?
At this point my choices are, start contributing to yarn and npm development, or get my ass in gear on learning Elixir and Rust. I have been wondering for maybe 18 months if I might be 'done with Node'. I think I've had it backward this whole time. Node may in fact be done with me.
I have been wondering the same thing. I left node for 8 months and I come back to see a lot of things have been abandoned in favor of yet another wheel implemented a bit differently. I wish changes were more visible and subtle. Rewriting seems like a plaque to js ecosystem except no one rewrites some really old unmaintained dependency we have hidden in every new shiny project.
I'd wager most people who use yarn even installed it via the npm CLI.
Didn't GitHub set up their own npm registry recently? Shots have been fired in this regard. Which, now that I type that out, makes me kinda wonder how amicable this purchase was...
It'd be such a shame if something bad were to happen to your lovely repository...
How separate from MS has GitHub been in day-to-day operations?
This is as good as Google acquiring Youtube because Youtube needs an insane amount bandwidth and it was a perfect fit for Google's infrastructure and ad platform.
It's just sad to see Google not playing the Developers game well.
The existing npm ownership model is markedly less clear and has led to several problems, including the transfer of package publishing rights to bad actors without anyone being aware. On the whole, npm accounts and orgs were always just an unnecessary abstraction that obscured the actual provenance of software, of which GitHub is the de facto source.
The worst option has been Elm's system where the whole package system requires you to not only use GitHub, but when GitHub in down (which isn't uncommon unfortunately) packages that weren't cached locally were inaccessible with no mirroring options.
Hopefully we can integrate repository information to packages meta data such that you could be aware of a change of ownership even for a globally namespaced package.
That said, and just in case their notoriously warlike legal team manages to fumble this somehow, I'd like to take the opportunity to remind every other frontender that Verdaccio (https://verdaccio.org/) exists, is easy to implement, and relatively low maintenance.
You can blame AWS/GCP for letting GitHub & npm be acquired, how many years were they on the open market?
Most of the $$$ in OSS is being funneled towards rent-seeking major cloud providers that are hosting OSS software, whom should all have blank checks with the money they've reaped so far, but seems only Microsoft has the strategic savvy to focus on acquiring the obvious targets for increasing dev mindshare. I don't fault them for their M&A's, it's just good business.
IMO this shows the importance of separating technology from platform. Ideally we would have non-profit groups with good governance & corporate support (rather than control) to grow these technologies. If an open source project can be acquired, it's only so free.
TypeScript and VS Code have been an invaluable contribution to the community. I'm a daily user of both and so thankful for the talent, ingenuity and effort that have gone into them.
How Microsoft have managed the acquisition of GitHub, giving them autonomy and infrastructure support - so far, it's been all around positive.
Now with NPM under their wings, the centralization does worry me somewhat. I hope there are conscientious decision-makers who will guide the project for the good of community and ecosystem.
Smart, have no idea where AWS or GCP's control team are at when these strategic plays are going down.
Stuff like this is what irritates me. Even small vps providers have this.
- They want to sell Azure Services
- Most (if not all) NPM packages already live on github
- NPM has a business revolving around package management, including private npm instances and increasingly around node/package security
- This being primarily a business that will sell to has-money businesses (e.g., medium to large businesses, Fortune 500 corporations etc)
So, given all of the above, it makes sense to have a vertical selling into one of the fastest growing package management ecosystems where you can be the "full stack" provider of developer/enterprise tools.
I don't think its anything beyond this, personally. I expect to see a lot of pushes to integrate with Azure Pipelines, cloud deployment etc. centered around this.
I wonder if they'll buy Passenger[0] next, its a popular (in my experience) to deploy nodejs applications.
Critical open source entities are bought by private company. I understand the need for money and sustainability these entities need, but it's really a shame that the open source community doesn't "own" themselves.
Most people don’t know, in these open source acquisitions by for profits there’s money involved and “founders” get an exit. Not always clear To the public who those are or what they took home from a mostly volunteer effort.
> GitHub, the developer repository owned by Microsoft, made a little deal of its own this morning when it bought JavaScript packaging vendor npm for an undisclosed amount.
https://techcrunch.com/2020/03/16/github-nabs-javascript-pac...
The way people think Microsoft's embrace of open source, GitHub, and now NPM is genuine is completely ridiculous. Microsoft had to change because much of where the action was is on *nix systems. Microsoft will start to use these companies to make developers embrace Microsoft services. It's only a matter of time.
Banning python from Github? Requiring \r\n for NPM packages? What's the move you're afraid of?
I still think this is good news, given where npm is coming from, but it's certainly not risk-free.
Until we come up with better trusted federation protocols there will be natural monopolies, but that doesn't mean they get unchecked power. We have laws for that.
Future "5-10 years down the road" me knows this will suck, ending up where all concentrated monopolies end up...
If developers love Github, they love the cloud. Microsoft is betting big on the cloud, they lost the Mobile war but they definitely want to be the developer and cloud darlings.
https://news.ycombinator.com/item?id=21031266
I also predicted a few more controversial things but if you think it terms of ecosystem and cloud market strategy, then it makes perfect sense.
What I'd not hope : MS changes strategy with change of people etc and npm and GitHub rot.
This is already happening with Windows and SQL server licensing. This will happen sooner or later.
https://en.m.wikipedia.org/wiki/Deno_(software)
Built by the node team to replace node.
However even a non-.NET web-developer now could be using quite a bit of Microsoft owned tech; VSCode GitHub npm Azure
I don't fully understand the way it's governed from this article.
> Later this year, we will enable npm’s paying customers to move their private npm packages to GitHub Packages—allowing npm to exclusively focus on being a great public registry for JavaScript.
Packages will continue to develop its npm registry. We have a lot of work to do in securing the software supply chain.
It'd be wonderful, as a package consumer, to have visibility into some security metrics for a given package. This would be useful both at initial install time, and when the package is upgraded. Something like:
1) who are the latest commits GPG signed by?
2) is the package publisher using 2FA?
3) what is the security profile of all dependent packages?
4) are there any new authors (directly or via dependencies) since the last version (with links to the author and their contributions).
These might help avoid prior situations where popular packages get injected with malware by new maintainers.
Somewhat related, I believe NPM pulled in (or co-opted) some of the heuristics from this: https://github.com/npms-io/npms-analyzer (but those don't seem to include any of the aspects I suggested above).
Sometimes I wonder what the business world (and the internet) would be like if mergers and acquisitions weren't allowed. Like, if businesses had to be sustainable or they'd just die, rather than capturing a whole market while eating VC money, maybe we'd all be better off? All of the really embarrassing stuff coming out of SV would just go away? Just Pinboards and Sourcehuts and Mastodons ruling the web?
I'm capitalistically illiterate, so somebody please tell me why this thought is stupid.
If we did that, it would be a crazy waste of resources. The alternative is to let another company buy the stuff... and if a company buys the failed company's tech, equipment, and hires their staff... that is basically the same as buying the company.
Why is there a for-profit corporation behind every open source project these days?
https://news.ycombinator.com/item?id=19838122
Somebody replied "Microsoft won't acquire npm for sure."
The product Github is probably most interested in is NPM as a repository for packages, not its CLI.
I'll be switching from Github to other providers for my own projects, and use a different editor soon (using vscode now).
Their strategy from my perspective is to ensure Linux does not become a competitor for their desktop OS.
1: it never had Linux support.