Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I never quite got a warm-fuzzy feeling from npm -- the tool, the service, the company. This announcement does nothing to help, from my perspective. Is my dependency on this or that JavaScript library something that really needs to be owned by a for-profit company?

I also kind of wonder what is the real value of a centralized repository versus just directly referencing git repos. I haven't used this gpk[0] project yet, but it looks like an interesting alternative, on paper.

[0]: https://github.com/braydonf/gpk



You'd be surprised how often git repos disappear when you have 100s or 1000s of deps.


You can still reference repos directly with npm.


Much better: mandatory vendoring of packages. Can't break and being forced to push the packages to the repo makes you appreciate the lack of transient dependencies.


Immutability and semver are the reasons


Can't we get all that directly from git repos and signed tags?


People can take down their git repos, or remove branches/commits/tags.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: