Now Ponder Mistakes: NPM's heavy-handed management prompts JS code registry challenger The recent management change and layoffs at JavaScript accessory outfit NPM Inc prompted several former employees to speculate that the company's alleged union-busting push toward profitability may well spur the creation of competition. The Register was also told to pay attention to JSConf EU in June as a possible launchpad …
I've just done a duplicate content check on my tiny (80Mb) node files, which already share as much as possible, and found 75% is duplicated. The 'normal' method of NPM-ing is to build a dependency library for each project! Not so great if I want a simple utility.
1 A registry should be a lot more intelligent than this.
2 Throw-in code and forget is a recipe for poor quality code. Oh yes somebody else comes along to fix the crap (out of frustration) that's good... But without curation eg retiring superseded and pointing to replacements and taking responsibility for doing so, it's going to be a free, handy soup-kitchen.
"The 'normal' method of NPM-ing is to build a dependency library for each project!"
Well, duh. Each separate application wants to know it can run without interference with its particular set of library requirements. If you don't like having a separate 'registry' per application, then you want an OS. NPM isn't one.
You don't like that architectural decision? Want to propose another that is more difficult for application authors? Can you see a way to get buy in? Great! A benefit instead of a whinge, rah!
As for "poor quality code", that's not the mail carrier's fault.
"But without curation" There's a *lot* of crap out there. I've seen packages of one line of code, a variable initialization. Unused elsewhere, even by the module author's other modules. A rejected idea, neglected, un-garbage-collected. Crap.
If you want curation, then you want a curated registry. Good luck staffing that. That's a problem neither you nor I know how to fix.
Hello there, I'm Victor Bjelkholm from the article!
> A registry should be a lot more intelligent than this.
I agree! That's why Open-Registry doesn't have a full copy of the npm registry but rather builds up a cache after proxying requests. So we'll only serve packages that are being used by people, not the rest.
Also, another fact that happens behind the scene is that there is de-duplication happening between all packages in the registry. So if there is two packages with identical content, the actual data will only be stored once and the other packages references that content.
This de-duplication also happens between versions of packages, so we only need to store the changes of each version, not the full package.
> Throw-in code and forget is a recipe for poor quality code
Agree here as well, but that's another problem aside from a for-profit company owning a important piece of open source infrastructure.
There some ideas on how to solve this, offering curation is one of the ways for example. We'll see what happens with this.
int main(enter the void)... The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
