Author here. Thank you for the feedback. I may tackle a history of the registries from netlib and CTAN forward in the near future.

For this article, I deliberately kept the scope limited because it was getting rather long.

I was around for the initial discussions on CTAN having run a popular FTP archive for TeX-related software in the late 80s/early 90s. Given the heterogeneity of computing platforms in those days (EBCDIC vs ASCII, bigendian vs littleendian, CR vs LF vs CRLF to separate lines, blocks vs streams for file structures), even a relatively straightforward text-based archive had its potential footguns. Add in the lack of anything resembling a reliable cross-platform scripting language (Perl was the first contender in this space, and didn’t have the insane cross-platform reach TeX did at the time) and there were some rather heroic efforts to use TeX itself as the scripting platform. The best-known and most widely used of these would be docstrip which was used as a sort of WEAVE/TANGLE for TeX code, but I remember there being an effort to also do some translation of files and out of BASE64-encoded format for reliable cross-platform transport. The original CTAN FTP server in the UK also had the cool feature that if you wanted the contents of a directory, adding .zip to the end of that directory name would return the directory’s contents zipped.

Being a first mover has had its drawbacks of course. Most notably, the lack of any sort of versioning of dependencies and that everything is functionally in a single flat directory (even if on disk it’s arranged in a hierarchical tree, that tree is flattened for all inputs). People who complain about the functionality of newer dependency managers have no idea how much better even the worst are compared to what it was like in the past.

Indeed. In the old days, we had to write our own malware!

Kids these days have it easy…

I really wonder who you are talking about.

I never saw anyone ever, even in the deepest pits of the internet, complaining about software registries per se. Even ultra-crackpots rarely get to this level. The regular complaints are always about very specific points around the culture of individual package registries. Even the most ardent NPM critic will be the first to admit that the general idea is per se great, and it is in practice it is useful, but the execution is lacking in some aspects, often exclusively cultural. Nobody is trying to throw away the baby with the bathwater.

Package registries are definitely useful and important. They don’t need someone misrepresenting valid criticism in order to be useful.

The lack of empathy and the blindness to those tradeoffs shows a lack of understanding of engineering itself, not only its history.

Beware this mindset. While it is completely reasonable, know that probably hundreds of new software developers enter the workforce every day, they hear us bitching about package registries like npm, and lack the experience to distinguish baby from said bathwater.

A strawman? Sorry, but not sorry. I will keep defending mine and other people's ability to criticise things that have plenty of room for improvement.

Go ahead. I'm not telling you not to complain, just reminding you that when you do complain, is you don't provide context, you deny others that knowledge

> Even the most ardent NPM critic will be the first to admit that the general idea is per se great, and it is in practice it is useful,

It's to be blackpilled about humanity. They're a natural, useful, obvious thing to do, like solving world hunger. And then everyone gets obese, and, somehow, it feels like we're worse off. It's tragic. Because of the leftpad incident, I now read Nick Land.

> but the execution is lacking in some aspects, often exclusively cultural.

Is that a thing I can do? Can I just pull the "cultural" emergency lever to justify anything?

It's fine if everyone owns 3 firearms; the reason shootings are up is a cultural issue!

> Nobody is trying to throw away the baby with the bathwater.

Reject modernity; embrace tradition. c:<

Can you think of any way to prevent the slouch toward mediocrity and supply injection attacks that come along for the "software registry" ride? I can't. It's like trying to reverse a thermodynamic reaction. It's trying to uninvent gunpowder. It's trying to have networking with 100% uptime. It's trying to have a free lunch.

Ok everyone else, I'm not gonna touch this with a ten foot pole.