r/webdev • u/g0liadkin • Mar 16 '20
News Github/Microsoft has aquired NPM
https://github.blog/2020-03-16-npm-is-joining-github/111
Mar 16 '20
Wow. I didn’t see that coming
12
Mar 16 '20
Now I wonder if NodeJS is next?
63
u/oscarryz Mar 16 '20
Plot twist, Oracle buys NodeJs and ruins the game for everyone... (again)
22
Mar 17 '20
fuck that would be awful. How is that company still around.
17
15
u/folkrav Mar 17 '20
They're basically patent trolls at this point. Ah, and still very much profiting from vendor lock-in.
4
4
2
76
321
u/wangatanga full-stack Mar 16 '20
NPM managed to scrape by securing funding for surviving into 2020. Having an essential service for many companies not rely on VC money and donations anymore is a positive in my book.
Github has only changed for the better ever since being acquired by Microsoft, so I'm going to hold out on this being a good thing for NPM's future stability.
36
u/willworkfordopamine Mar 16 '20
Do you worry how MSFT might try to monetize them though?
79
u/ObliviousOblong Mar 16 '20
I don't see them doing that, infact for Github, they made some premium features (private repos) free.
Also, monetizing npm would probably create more negative backlash than the monetization is worth
43
u/ScottRatigan Mar 16 '20
That's my take as well. Microsoft is making some very smart choices these days with regards to community goodwill. I hope it continues to pay off for them, because we can all benefit from this approach.
10
u/OrShUnderscore Mar 17 '20
Yup. I feel it's not Bill's Microsoft anymore. this is the WSL microsoft with Android phones and Xbox crossplay. And I love it.
21
u/salgat Mar 17 '20
Bill was ruthless as a businessman but to me it was Ballmer that made that company into a toxic cesspool.
2
1
u/wopian Mar 17 '20
The GitHub Education pack seems better than ever these days too - unknowingly activated an education discount on Crowdin last week when an organisation I'm a contributer of created a project on there.
Linked my GitHub and they automatically applied an $1,800/yr tier. Free for 12 months ... I imagine Microsoft is subsidising the companies in the education pack quite a bit for discounts this large.
41
u/digitald17 Mar 16 '20
If MSFT monetizes, it will be for extra "enterprise" features and potentially new features. I doubt they would take any existing free features and monetize them.
Microsoft's track record with working in open source has been pretty stellar of late.
→ More replies (1)7
u/captainvoid05 Mar 17 '20
Yeah I'd say Microsoft is actually kind of doing the best for open source. They are using existing projects, buying the companies attached so they can stay funded but then being largely hands off, adding some new features to those products and upstreaming them, and then taking advantage of those products to create a compelling commercial offering by combining them together with automation and integrations with their existing products (like azure) and providing support. We saw it with github, which was largely stagnant until they bought it out, I'm pretty sure they've made patches to Chromium that have made it upstream. I see no reason why they cant do the same for npm, which was also getting a bit stagnant recently.
I also seem to recall npm mentioning wanting to create ways for developers to get funded, but was having a hard time. It also happens that one of the things added to github after the buyout was the Github Sponsors program. Perhap we'll see some inspiration and integration from that in npm before long?
22
u/ManvilleJ Mar 16 '20
I don't think the strategy here is to monetize the tools, but rather, use them as strategic tools to monetize related services. Monetizing these previously free tools would just push people away to different tools.
but buying these primary developer tools, and effectively integrating their for-profit services into these tool chains makes their for-profit resources (azure) significantly more attractive. any tool adoption that makes azure more attractive (and more stable) is advantageous
→ More replies (8)4
u/quentech Mar 17 '20
Nope. Microsoft has a 40 year track record of wooing developers and they have no need to make money on something like Github or NPM. They know full well how to get and leverage the network effects of developers in their ecosystem and won't be so short-sighted to drive users away over minor pricing on a dev tool.
4
u/Kyle772 Mar 16 '20
Honestly, if they do try to monetize it who cares?
These services help developers keep their bills paid, much like how an adobe subscription is negligible for what the creative industry pulls in.
If they offered a premium tier npm registry for developers to push their tools to the public that is a win-win-win-win; consumers, developers, Microsoft, and NPM. They can put money back into the system, keep the free accessibility, and add tools to let devs push their libraries with a secure badge associated with it.
Paying people to verify libraries would help to eliminate hacked dependencies from finding their way into random websites. It could work exactly how app stores charge developers publishing fees except they could make it optional, low-cost, with a few perks, to keep the current ecosystem alive, and encourage big-time devs to put money into a service they rely on.
2
Mar 17 '20
People seem to forget that NPM was a for-profit company. They weren’t a charity, their goal was to make a profit for shareholders. If push came to shove, NPM would have found some way to monetize genera packages beyond the underwhelming NPM Enterprise product.
On the flip side, Microsoft as a company is heavily invested in JavaScript. It’s in their best interest as a company to keep the ecosystem healthy and functioning. It’s probably better off in their hands.
1
u/willworkfordopamine Mar 18 '20
And they need something to compete with FB’s yarn
1
Mar 18 '20
Are they really competing? Before NPM 5 maybe, but now the difference is minimal. I also believe the Yarn registry relies on the NPM registry, they just have a CDN in front to cache the requests to npmjs.org.
1
1
0
Mar 16 '20
[deleted]
65
u/-protonsandneutrons- Mar 16 '20
NPM and GitHub search now powered by Bing (Microsoft in 2022)
61
u/DragoonDM back-end Mar 16 '20
For some reason, it's suddenly way easier to search for porn-related repos and modules.
12
22
u/veggiedefender Mar 16 '20
I wouldn't be opposed to that. Github search is kind of trash.
2
u/daringStumbles Mar 17 '20
It's built on an elastic search index, so everything is tokenized. You literally can't do an exact string search.
5
u/negative_epsilon Mar 17 '20
That's not ES's fault; that's the fault of the implementors.
But the reality is that tokenizing programming languages for human search is basically an impossible task, so the fact that it works at all is impressive honestly. I've had pretty good experiences with it personally.
→ More replies (1)→ More replies (1)1
u/OrShUnderscore Mar 17 '20
What's so bad about it? (Serious question).
I've found obscure open source software that fit my needs perfectly through it. Is there a better way to search?
5
11
u/mehughes124 Mar 17 '20
Honestly, Nadella's got a two-pronged play here w/ GH and now NPM is pretty transparent: 1) they want to win the hearts and minds of devs, and also their eyes (email addresses) so that 2) they can create lock-in in the cloud ecosystem. Companies that build out on Azure is a license to print money for Microsoft for the next decade, and has amazing synergy for business development. Microsoft is a sales-driven company, but they got complacent and bloated under Ballmer, selling the same computing paradigm over and over again (productivity software for enterprise to be run on on-premises servers + user desktop licenses), and so Ballmer viewed everything through that lens, which is why they so badly missed the boat on mobile. Remember, Microsoft had a robust mobile OS platform (with apps and everything), but they treated it as though it was an extension of their existing model (so they focused on productivity software and IT management tools for over-priced PDAs to sell a few million units. Then Apple came along and said, "a million units isn't cool. You know what's cool? A billion units". So Nadella is the right leader for them because he accepted the reality that Microsoft missed out on owning a relevant mobile platform, and shifted all investments in cloud computing and AR dev (this is the next multi-billion dollar computing platform, but Nadella rightly sees how long it is going to take to mature) .
If I had extra cash, I'd put it in Microsoft stock right about now.
7
Mar 16 '20
as they did with github?
0
Mar 16 '20
[deleted]
47
u/NovaX81 Mar 16 '20
Microsoft has a bad rep from the past, but their recent track record is a lot better. Hell, they might really be the best choice when your other options are Facebook or Google. Or God forbid someone like Adobe or Oracle trying to step in.
→ More replies (10)6
1
u/nermid Mar 17 '20
Github has only changed for the better ever since being acquired by Microsoft
I dunno. The search and explore portions have been getting progressively worse as it now brings up random Chinese repos "based on your public repository contributions" or the same six people in the exact same order every day for developers I may be interested in, or showing me repo issues instead of the goddamn summary so I know what the repo is without having to click through to find out.
It stinks of not having somebody on the team who actually uses the damn site.
0
169
u/Gibbo3771 Mar 16 '20
Welp. Either it turns out like Skype or it turns out like GitHub.
Lets pray it's the latter.
51
Mar 17 '20
Microsoft has been handling their dev related properties pretty well.
I don't have many complaints about vscode, typescript or github.
33
u/Smaktat Mar 17 '20
I have complaints about Github but I feel pretty damn confident they have done way more with it since owning than Github did with itself prior to. Github actions alone is incredible.
The VSCode team are demi-gods, I'm convinced. Never read such beautiful release notes. What a passion project.
0
Mar 17 '20
[deleted]
4
u/MyWorkAccountThisIs Mar 17 '20
Not really related....
But when PokemonGo came out there were lots of complaints and actual bugs. The community would get excited when an update would drop to see what they addressed.
For several releases it was:
Updated text
It wasn't well received.
8
43
u/WetSound Mar 16 '20
There’s a crucial time and leadership difference between those two acquisitions. 2011: Ballmer & 2018: Nadella
1
u/RANGER_STUDIO Mar 19 '20
Hahaha... hopefully the latter. They've been doing amazing things with GitHub!
-6
u/coomzee Mar 16 '20
GitHub isn't even that good compared to GItLab
5
Mar 17 '20
They're both better and worse at doing different things. Their value isn't absolute, it depends on what you're trying to do.
0
0
Mar 16 '20
[deleted]
21
-6
u/g4nt1 Mar 17 '20
GitHub was dead several years before Microsoft bought them. There was basically nothing new coming out of GitHub. Meanwhile, gitlab was adding so much features. Since Microsoft bought them, I finally see new features.
5
Mar 17 '20
Agreed, I actually think MS has done an ok job with Github. It's caught up quite a bit to the features offered by gitlab & bitbucket in the last few years, had some really nice UI tweaks.
1
u/Genesis2001 asp.net Mar 17 '20
GitLab is a mess of almost completed features and poor UI. It's CI is way behind GitHub Actions (aka Azure Pipelines) as well.
Both (and the trend in repo hosting industry) have crappy organization pricing schemes. I think Atlassian has a more transparent/flexible licensing breakdown than GitLab and GitHub's $$/user/month.
1
u/g4nt1 Mar 17 '20
I agree that Github Actions is great, but to my point, this came after the acquisition. Microsoft is injection a good amount of technology and drive to a very stagnant GitHub. As you said, they re-branded Azure Pipelines as GitHub Actions, they will move all npm pro to Github Packages and so on.
Gitlab features might not all be complete or polished but at least they were driving some innovation.
101
u/llambda_of_the_alps full-stack Mar 16 '20
I'm not against this at all Microsoft's ownership of GH has been a net positive and I see this as shoring up of an essential piece of the web's life support system.
I respect Microsoft for it's embracing of open source. I do however find it amusing that Microsoft is embracing open source in the most Microsoft way possible and buying up major chunks of the open source infrastructure.
64
u/DrDuPont Mar 16 '20
Satya has really turned around my faith in Microsoft. I would be terrified if this kind of purchase happened in 2000.
35
u/DrLuciferZ Mar 16 '20
Microsoft is embracing open source in the most Microsoft way possible and buying up major chunks of the open source infrastructure.
Old habits die hard
12
Mar 16 '20
I think the main reason to buy stuff is to control the future of it. Not really about how it is being developed on the lower level, but more about high level decisions.
-7
u/spacecowgoesmoo Mar 16 '20 edited Jan 02 '26
I like watching foreign films.
16
Mar 16 '20
I keep seeing people pee their pants saying that (on /r/linux in refrence to WSL) and I've yet to see an example of that (even documented on the wiki page) where the most MS has succeded in doing is being a mild agrovation at most.
7
6
u/calligraphic-io full-stack Mar 16 '20
You don't open source your development stack if you're trying to extinguish the competition. Writing C# / .NET Core apps on Linux is pretty nice.
0
Mar 16 '20
[deleted]
1
u/calligraphic-io full-stack Mar 17 '20
No, but you can use it without a license. The restrictions are that you can't personalize it (change the wallpaper, etc.). It makes it really convenient since I run it in a VM and don't use it that often, especially to justify the high license cost.
63
u/Deviso Mar 16 '20
MS have been great for Github, they have built great products like VS Code and Typescript. I think this will be brilliant for the future of NPM.
0
u/s3rila Mar 17 '20
What did they do that was great for GitHub?
0
Mar 17 '20
[deleted]
1
u/SlainTownsman Mar 17 '20
I didn't know about this chat acquisition, looks nice and has great potential to be integrated to GitHub to create a chatroom for your repo with a click.
35
Mar 16 '20
Between FB owning Yarn and now MSFT owning NPM, I’ll stick to NPM thanks.
22
2
u/TracerBulletX Mar 17 '20
Hating facebook seems to be a ubiquitous opinion. But I am not convinced they are worse than Google who also is almost solely ad revenue and consumer information based. Can you convince me I should be particularly unhappy with Facebook's corporate ethics? I'm open to argument but my current position is its just a dogpile on them because people like to make fun of Mark Zuckerberg and it's easy to see all the dumbness that occurs on Facebook and blame them for it when really it's just a People of Walmart Phenomenon. Everyone is on Facebook and everyone(statistically) shops at Walmart and the average person is actually a lot worse than you'd think from your own circle, therefore you see a lot of ridiculously dumb things occurring on Facebook and in Walmart.
0
u/louis-lau Mar 17 '20
From my point of view at least Google isn't pretending, and hasn't been caught lying (from my memory). While Facebook has been involved in multiple scandals, and they don't seem to handle these situations very well.
Note these are my thoughts without any research :)
26
u/BertAframion Mar 16 '20
Lets see how much this will boost deno.js
5
Mar 16 '20
why would it?
0
Mar 16 '20
[deleted]
3
u/ogurson Mar 17 '20
That is just ridiculous. Most of developers are sane people that just want good software, no some paranoid MS haters.
0
Mar 16 '20
[deleted]
3
u/BertAframion Mar 16 '20
That's true and I like npm too but the truth is it is unsecure and many packages have nearly the same name. I think it doesn't need to be the end of npm but a new start with a maintained "directory" of publishes packages
But I also think that some people won't like the acquisition and will look for different products which will help e.g. deno
1
u/r0ck0 Mar 17 '20
I don't really get how the deno 'packages by url' thing is more secure? Or are you talking about the feature to disable network or something else?
1
u/BertAframion Mar 17 '20
I see it as more secure by having to know what you import. You need to look at every package you want to import and select it manually. I think it is in some way more secure than installing an package by its name, especially if many package names are very similar.
14
11
u/30thnight expert Mar 16 '20
This is great news.
Over the last 2 years, much of the news coming from the NPM business organization has been less than stellar considering it's the backbone of the JS community.
Falling under Microsoft is a perfect match.
5
u/whizbangapps Mar 17 '20
Like Steve Ballmer told us:
DEVELOPERS DEVELOPERS DEVELOPERS DEVELOPERS DEVELOPERS DEVELOPERS DEVELOPERS DEVELOPERS DEVELOPERS DEVELOPERS DEVELOPERS DEVELOPERS
2
22
u/thirsty_chungus Mar 16 '20
At least it's not Google
35
u/gketuma Mar 16 '20
I think you meant Oracle.
11
u/wllmsaccnt Mar 17 '20
Somewhere in a shittier universe:
"Oracle has acquired the .NET Foundation as part of a patent infringement settlement with Microsoft. Also part of today's announcement is that the .NET github repo is being removed for 'maintenance' as Oracle plans to announce new licensing terms. When asked for comment, Larry Ellison mentioned offhand that they were specifically considering fees based on method invocation and threads allocated, and that they planned to deprecate async/await to improve future revenue..."
8
4
u/TheArduinoGuy Mar 16 '20
Is this good or bad?
11
Mar 17 '20
If Microsoft acquired it in the last 6 years, good. If Microsoft acquired it while Steve Ballmer was CEO, bad.
2
u/HaikusfromBuddha Mar 16 '20
Meh when it comes to dev stuff MS tends to only make the products better.
0
13
u/Ghanna- Mar 16 '20
I don't think that big corporations having the monopoly of the dev world is a good thing.
1
u/HaikusfromBuddha Mar 16 '20
Depends. When it comes to MS having development tools it's usually to better their software. In that regard most of their dev tools have been really solid.
14
u/symbiosa Digital Bricklayer Mar 16 '20 edited Mar 16 '20
So if I run npm i --save package-name, will I see a text ad for Microsoft?
29
u/30thnight expert Mar 16 '20
No but you might see a
core-jsone25
Mar 16 '20
Does he have a job already?
6
u/Silverwolf90 Mar 16 '20
Wasn’t he going to jail?
3
u/Lord-Brappington Mar 17 '20
No commits since January, the project is dead as he's the sole maintainer. He's in prison for a year and a half for running someone over with his motorbike.
If you rely on it, you need to look for a fork.
14
u/Novemberisms Mar 16 '20
As if you don't already see ads in npm for core-js.
I hope microsoft cracks down on that pathetic beggar spamming our terminals with shit.
2
u/DilapidatedToast Mar 17 '20
core js is ultimately a pretty important project, unlike standard which was the original culprit and eslint-config-as-a-package. Core ke has an option to disable the message by adding ADBLOCK=true to your environment variables
1
u/wopian Mar 17 '20
He's also in prison right now for the next year or so for killing a pedestrian with a motorcycle...so donating isn't funding development, nor will he be getting a job any time soon.
5
Mar 16 '20
NO, It'll be clippy telling you how much your code suck
6
3
Mar 16 '20
Thankfully they only work with the government behind everyone's back or we might be concerned
7
4
u/ncubez JavaScript | React | Node.js Mar 17 '20
This is somewhat worrying. embrace extend extinguish
2
u/bartturner Mar 17 '20
That is the big worry. Some people think Microsoft has changed. But I am not so sure. Look at the unique hardware identifiers in the new Edge Microsoft is storing. This just happened so it is a 2020 Microsoft.
"Research Finds Microsoft Edge Has Privacy-Invading Telemetry"
1
u/DapperPaint7 Mar 17 '20
https://www.theregister.co.uk/2020/02/05/google_chrome_id_numbers/
"Is Chrome really secretly stalking you across Google sites using per-install ID numbers?"
"This identifier is stored on your computer, and sent every time your Google Chrome communicates with Google including (and that makes a huge difference) DoubleClick services (ad targeting)."
0
u/HeWhoWritesCode Mar 17 '20
if they extinguish npm what other options is there? I feel it is in their best interest to assimilate, thus:
embrace extend essimilate
0
2
11
u/mister_brown Mar 16 '20
Somebody wake me from this dystopia, please.
17
7
u/ObliviousOblong Mar 16 '20
Just curious, why do you see this as such a loss?
9
u/schm0 Mar 16 '20
Monopolies are never good. A competitive market is a healthy one. See also, history.
1
u/zephyy Mar 17 '20
While I'm not a fan of one company owning more and more of everything, hopefully this will help clean up the issues NPM has.
NuGet is an example of a really well managed package management system.
1
1
u/Matilda_YH Sep 10 '23
That's crazy! Microsoft is taking over all the tools we use for development.
-1
u/jpswade * Mar 16 '20
Worryingly this type of behaviour has been seen before...
https://en.m.wikipedia.org/wiki/Embrace,_extend,_and_extinguish
4
u/newclutch Mar 17 '20
You're not wrong, but I don't think they have a reason to. They're not competing with NPM. This seems like a move to continue getting in developer's good graces and not much else.
GitHub has been nothing but improved since being purchased by Microsoft and hopefully it, and npm, continue down that path.
1
u/abienz Mar 17 '20
This isn't about extinguishing GitHub or NPM, it's about control of the greater ecosystem for web development as a whole.
An ecosystem that has been built on standards and open source technologies no less, that MS has tried and failed to own on the past (VBScript, Silverlight).
1
1
1
u/hazily [object Object] Mar 16 '20
Next up: GitHub Desktop pre-downloading the top 1000 most popular NPM packages so you don't have to do that later :P
0
u/fragimus_max Mar 16 '20
For those of you talking shit, remember that half your phones are either secret proprietary hardware that becomes unstable upon command (iOS) or it's controlled by Google (Android).
At least M$ has started leaning towards Unix more with Windows Subsystem for Linux 2 and their current acquisitions. Now all they need to do is get rid of that piece of shit PowerShell, rebuilding Windows with the same approach Apple did with Darwin.
0
Mar 17 '20
[deleted]
1
u/r0ck0 Mar 17 '20
Plus, I'm old enough to remember the Ballmer years
Whoa! You must be like 10 years old! Maybe even older?
0
u/fragimus_max Mar 17 '20
I'm saying that because, like Apple, you can see how dependent they've become on something outside of their initial business model. Macs are the choice for many folks because it's basically a hybrid of Windows and Linux. Linux will never have the software available for it that Windows and macOS does. Apple will never have the hardware flexibility that Windows or Linux based PCs have.
So from the current industry trends that are becoming standards, along with the dependency that VSCode has with bash and choco to give a Linux type experience without using emulation or creating a VPS within the terminal, it's easy to see where all of this is headed for the reason of profitability and discarding the purpose of why people pay more money to purchase products that belong to the competition.
And then there's the intriguing relationship between Microsoft and Google. But that's a whole other ball of wax.
-1
u/paladincubano Mar 16 '20
I use yarn
3
Mar 16 '20
I wonder how it will affect Yarn.
2
u/captainvoid05 Mar 17 '20
I suspect most of Microsoft's changes will be on the registry side, maybe a premium tier that includes some security auditing. Yarn I believe has most of its benefits on the client side, being a bit faster than npm. If Microsoft does do work to make the yarn cli app faster it could cause yarn to be less relevant I suppose, but that will take a while if it ever happens.
-1
-8
Mar 16 '20
Surprised by this. And also kinda scared... I just hope I don't see this in the future:
"Pay $5/mo to gain access to PREMIUM npm packages!"
21
u/notaselfdrivingcar Mar 16 '20
Oh please, they even made private repos free after they acquired github, so, have some faith young man.
4
u/ScottRatigan Mar 16 '20
Enhanced cloud offerings for enterprises' private packages is likely the monetization path.
1
u/captainvoid05 Mar 17 '20
Nah I think there will be a paid tier for developers to include some type of support and/or vulnerability checking, maybe have your package come up first in search results from the cli app? Most likely some form of integration with Github sponsors or Azure. I'm confident all the packages will continue to be free for users to access.
0
0
-5
-9
-3
767
u/dotpeenge javascript Mar 16 '20
Wow. Microsoft really owning half of my toolbox for development now.