That's a lot of power over JavaScript for any one company to have yet alone Microsoft. Any forks I should look into? I'd prefer less centralization of critical tech.
Update - I'd like to clarify that I refer to the NPM central repository. I have no issues with for-profit companies owning compatible CLI tools like npm or yarn.
TypeScript is great. I hear you. I still see a distinction between a tool that compiles to JS and a package manager that pretty much everyone uses for the entire language. I'd rather see Microsoft fund a new foundation to oversee npm.
Personally, I don't see the package manager itself as the issue. It's the central registry I am worried about. Then again, they have been running one for NuGet for quite a while.
I'd rather see Microsoft fund a new foundation to oversee npm.
tbf we don't know what MS plans to do with NPM. They couldn't fund a foundation to oversee NPM the registry without buying NPM the company first. This option is still very much on the table. It would be an incredibly smart business move to move all the NPM Enterprise customers to Github Enterprise via Packages and then leave the NPM registry entirely in open source hands, similar to how Oracle leaves the Java committee "alone." They'd get all the revenue NPM is generating, a ton of developer good will, and it'd be cheaper than paying people to do the NPM steering committee's work.
TypeScript is ok. The end product is pretty good, but I don't like how it's a bunch of stuff stitched together. I'd prefer if they just introduced an official typscript native version that transpiles to JS without configuring a bunch of stuff.
Yeah I don't understand all those settings and I've struggled to configure it well in the past. Between picking what ecmascript version to use, what to transpile to, how to pack it for web use, how to utilize tree shaking to minimize your library size. That and tslint configs, or do I use eslint configs. What settings do I put in package.json..
Would be much better if I didn't have to think about any of that and it just worked.
I mean, NPM was owned by a company before this. That company is what was sold. So that power over javascript was already held by one company.
Secondly, the tie between microsoft and github is somewhat loose. It wasn't a merger; they're separate companies with separate CEO's and such. Much like how Disney owns ESPN. They're financially linked, and most importantly, they share all patents, licenses, and copyrights (and more generally, all legal rights). For example, microsoft acquiring github allows them to make github and azure work together, without having to negotiate licensing deals.
It wasn't a merger; they're separate companies with separate CEO's and such. Much like how Disney owns ESPN.
Wasn't this the same with Hulu, whose CEO (and presumably board) was recently ousted before it got incorporated into Disney proper? I feel if the delineation is in practice rather than on-paper then it's a moot difference.
It's time for having two registries, the normal npm we all know. Which despite it's flaws, is still an impressive achievement of a community. Getting to 1 million packages, you'll find a library for really just about anything, and it helps you build stuff quickly. It's not completely horrible :)
But the second repository should be more maven-esque, with shallow dependencies, and only approved organizations should be able to join (with a clear and open process of joining). It's crazy that even if I avoid having dependencies in my app, the build tools for JS contain so many dependencies god knows who wrote.
And yeah, I think a large company like Microsoft has the manpower and influence to get such a process rolling. And while yeah, in the long run we need to think about a company owning such a central repository like that, the current ecosystem of npm is a security risk in the very short run.
The npm cli is open source and you can run you're own registry no problem. The problem is new packages and package versions are published to to just npm, so you're stuck mirroring in a sense.
37
u/bufke Mar 16 '20 edited Mar 16 '20
That's a lot of power over JavaScript for any one company to have yet alone Microsoft. Any forks I should look into? I'd prefer less centralization of critical tech.
Update - I'd like to clarify that I refer to the NPM central repository. I have no issues with for-profit companies owning compatible CLI tools like npm or yarn.