> It depends on what the alternative is.

Ruby Gems, PHP composer, PIP, etc. would all like a word with you....

https://rubygems.org/pages/sponsors

https://www.python.org/psf/

Isn't it more that NPM specifically has had a bumpy ride, and people are seeing this acquisition as a sign of better times to come, and it not being a value judgment of other open source initiatives.

Yeah, and the PSF is worried that the possible cancellation of PyCon could send the whole foundation broke.

The fact that there's a bunch of critical infra run on a precarious volunteer shoestring is not a good thing.

Maybe look in your node_modules folder sometime, eh? Or the Linux kernel. The whole world runs their critical infrastructure on volunteer work.

You haven't bothered looking at the contributers to Linux since 1997, I take it.

Hmm, not everyone is a volunteer...

That's a path but NPM already being a company with signficant VC investment would a transition to such a model workout with the existing stakeholders? Also NPM is quite a bit bigger than both the Ruby and Python library spaces.

> Also NPM is quite a bit bigger than both the Ruby and Python library spaces.

I don’t know, so I have to ask, what’s the metric here?

Perhaps because Node code bases when deployed cause the package manager (npm) to consume more bandwidth in general than comparable Ruby or Python code bases due to higher dependence on third-party packages?

As at Oct. 2018, the top 12 npm packages [1] were already doing more than 0.5 billion downloads a month. Granted, popularity has waned for a few of those top packages due to deprecation or new language features, for instance.

EDIT:

NPM’s announcement about the acquisition [2] provides up-to-date numbers:

“Today, npm serves over 1.3 million packages to roughly 12 million developers, who download these things 75 billion times a month ...”

1: https://news.ycombinator.com/item?id=18343604

2: http://blog.npmjs.org/post/612764866888007680/next-phase-mon...

You're probably right with all the one-off and fairly small dependencies in the npm ecosystem. Seeing those numbers would be pretty neat to compare side-by-side.

This is sad to read. Why does every project have to be profitable? If NPM is useful users (companies and people) can invest time or cash to support the operations and continued development. This foundation model has been successful across open source and prevents one company from changing the direction of a project to fit their own needs at the expense of everyone else. I think this was critical to the continued growth of open source software over the last two decades. If this trend of selling out to massive corporations continues it will be a major step backwards.

To be clear that's not what I am arguing here, I agree that package registries should, ideally, be owned and supported by the community. However NPM already had fairly significnat VC investment and as such any transition to a community supported model would be challenging.

The acquisition can be a good outcome for the current situation without it being the ideal state of things.

Profitable of not, they should not run out of money.

Would yo prefer npm infrastructure to be maintained and developed by the lowest-paid programmers they could hire?

Imhi Npm is two things a cli tool, and a central repo that tries to be the one and only js repo: to make money from that position. Their infra costs them money only because that was their angle for selling out.

Linux repos take the alternative approach to try to get as many mirrors as possible so it can remain free.

Microsoft did not buy npm to help it become free. Believe. They bought it because they rekon they can make buck out of it.

That buck comes from somewhere.

Nodejs going to the Linux foundation was good news.

Microsoft buying Npm is bad news.

Why would NPM run out of money? NPM is the primary vendor for worry-free distribution and management of private JavaScript packages for $7/month/user. In a time where bandwidth is basically free (outside AWS/Azure/GCP) that should surely pay for server costs and a handful of developers.

It probably isn't going to 20x VC money, but it sounds like it would be profitable to run as a business.

Agreed. It was profitable before, (no indication they sold at a loss), it will probably be profitable after for MS.

"2fa" sounds bad. That is clearly marketing bs for linking your npm account to a MS account with more personal info attached.

Ease of publishing will be the first thing to go.

Then the fun will disappear with MS as owner, like when Oracle bought Java.

Happy to be a rustacean.

Regards 2FA/Login: Except that Microsoft has not done this with GitHub. And NPM is joining GitHub not Microsoft. You will see non login vanishing in favor of GitHub Login for sure. And the second factor, see what GitHub offers. For me that is currently a OTP generator

Gihub already had a masssive social graph. They know who you are in terms of who you work for and who your CTO is. Npm does not know that about me. It has no sales channel.

GitHub is owned by the same entity that owns LinkedIn. Microsoft has really no problems cross linking persons. They can also easily link the source code between the systems etc (if they want).

And they will, to the extent possible by law.

And they will ask you, under the guise of 2fa, to confirm thier suspicions.

And $7 a month gets plently of new upgrade options offered.

All talk of mirrors gets brushed under the carpet.

Microsoft pwn all nodejs code except core and those savvy enough to spot this coming and distribute via debian repos.

I hope they dont use that Microsoft Authenticator app. That has never worked for me, never once got me logged in, and has locked me out of Teams on a couple occasions.

To my understanding you can use any app supporting the common standard there.

The alternative is that the entire source control system (GitHub) and the entire artifact registry (npm) are run by a giant multinational military defense contractor with close and longstanding ties to the US military. Did we forget so soon that the Snowden slides are PowerPoint?

I'm not sure that's an improvement in any way whatsoever.

The military is a MS customer, just like nearly everyone else on the planet. Calling them a “defense contractor” is a very long stretch.

No its not.

Boeing is a defense contractor. Northrup is a defense contractor.

MS? Not even a chance. What percent do you think of their business is actually government, beyond buying licenses just like nearly every other corporation on the planet.

No US company is better in that regard. I prefer one with an army of lawyers. Damn, should have gone to Oracle. That is a joke. A joke!!!

> Did we forget so soon that the Snowden slides are PowerPoint?

what does that mean? That Microsoft works for the NSA or something?

Microsoft does indeed work for and with the NSA. As an ASP they participate in the warrantless PRISM bulk collection program (they were the first!), and they also provide software and services (support) as a direct vendor.

Change my mind: package management infrastructure run by government as a public service should be the ideal end outcome for everyone.

Why I think this: private or volunteer models are unsustainable in the long run owing to funding uncertainties or conflicts of interest between stakeholders. Utilities that support the bulk of our technical infrastructure should be secured by public interests. Governments can keep things free.

Common objections:

- "Governments are inefficient". Depends on the area. The government tends to be inefficient in handling areas with direct consumer benefit, but less so in dealing with consortiums or private entities. Since private entities are the primary mainstream users of packages, I don't think government will be too slow on this front.

- "Governments will be malicious". This I don't doubt, but the solution for that is building better trust mechanisms rather than keeping a practical solution at bay, and for software at least such trust mechanisms are tenable e.g. see the CNCF's Falcon project.

I like Linux's decentralized approach.

That would work for Npm. Npm has enough problems that its worth running your own mirror for business continuity.

Microsoft are likely to make breaking changes immediatly.

> That would work for Npm. Npm has enough problems that its worth running your own mirror for business continuity.

And risk-averse businesses do already.