Ruby Gems, PHP composer, PIP, etc. would all like a word with you....
I don’t know, so I have to ask, what’s the metric here?
As at Oct. 2018, the top 12 npm packages [1] were already doing more than 0.5 billion downloads a month. Granted, popularity has waned for a few of those top packages due to deprecation or new language features, for instance.
EDIT:
NPM’s announcement about the acquisition [2] provides up-to-date numbers:
“Today, npm serves over 1.3 million packages to roughly 12 million developers, who download these things 75 billion times a month ...”
1: https://news.ycombinator.com/item?id=18343604
2: http://blog.npmjs.org/post/612764866888007680/next-phase-mon...
The fact that there's a bunch of critical infra run on a precarious volunteer shoestring is not a good thing.
The acquisition can be a good outcome for the current situation without it being the ideal state of things.
Would yo prefer npm infrastructure to be maintained and developed by the lowest-paid programmers they could hire?
Linux repos take the alternative approach to try to get as many mirrors as possible so it can remain free.
Microsoft did not buy npm to help it become free. Believe. They bought it because they rekon they can make buck out of it.
That buck comes from somewhere.
Nodejs going to the Linux foundation was good news.
Microsoft buying Npm is bad news.
It probably isn't going to 20x VC money, but it sounds like it would be profitable to run as a business.
"2fa" sounds bad. That is clearly marketing bs for linking your npm account to a MS account with more personal info attached.
Ease of publishing will be the first thing to go.
Then the fun will disappear with MS as owner, like when Oracle bought Java.
Happy to be a rustacean.
And they will ask you, under the guise of 2fa, to confirm thier suspicions.
And $7 a month gets plently of new upgrade options offered.
All talk of mirrors gets brushed under the carpet.
Microsoft pwn all nodejs code except core and those savvy enough to spot this coming and distribute via debian repos.
I'm not sure that's an improvement in any way whatsoever.
what does that mean? That Microsoft works for the NSA or something?
MS? Not even a chance. What percent do you think of their business is actually government, beyond buying licenses just like nearly every other corporation on the planet.
Why I think this: private or volunteer models are unsustainable in the long run owing to funding uncertainties or conflicts of interest between stakeholders. Utilities that support the bulk of our technical infrastructure should be secured by public interests. Governments can keep things free.
Common objections:
- "Governments are inefficient". Depends on the area. The government tends to be inefficient in handling areas with direct consumer benefit, but less so in dealing with consortiums or private entities. Since private entities are the primary mainstream users of packages, I don't think government will be too slow on this front.
- "Governments will be malicious". This I don't doubt, but the solution for that is building better trust mechanisms rather than keeping a practical solution at bay, and for software at least such trust mechanisms are tenable e.g. see the CNCF's Falcon project.
That would work for Npm. Npm has enough problems that its worth running your own mirror for business continuity.
Microsoft are likely to make breaking changes immediatly.
And risk-averse businesses do already.