News for hackers. Stuff that matters.

A comment on Changes to Npm's unpublish policy. Parent comment

Re:Changes to Npm's unpublish policy by diggan on Tuesday March 29, 2016 @06:19PM (#11385403)
> There just isn't really a good way to do this in/with NPM, and the top google results seem to actively discourage pursuing this pattern.

There is. The only problem is fetching packages from a central registry (registry.npmjs.org). The rest that comes with the NPM CLI is good stuff.

One way, that I have been exploring is to allow NPM to download from IPFS instead, available over at http://everythingstays.com, and that's just one way it can be solved.

The top-level comment have more tools that you can use (but doesn't seem to have been implemented yet)

[ Parent | on HN ]
Re:Changes to Npm's unpublish policy by zer00eyz on Tuesday March 29, 2016 @07:28PM (#11385811)
> The only problem is fetching packages from a central registry (registry.npmjs.org).

As I understand and have implemented vendoring in the past, I have always thought of it as a "no external dependencies" solution. If your data center gets DDOS'd durring deployment, things should just work when the attack subsides (assuming you have access). Fetching packages from xxxx.npmjs.org would be sort of antithetical to that idea. Or am I missing something.

Everythingstays seems like it would do the job mostly, as long as the "fall back to NPM" can be shut off.

[ Parent | on HN ]