&quot;Github is acquiring npm&quot; then. &quot;NPM is joining Github&quot; sounds like you&#x27;re just using Github to host your stuff.

Then saying &quot;GitHub is acquiring NPM&quot; would&#x27;ve been a more accurate way to say this.

Today we&#x27;ve announced that we&#x27;ve signed an agreement to acquire NPM but we technically have not acquired them yet (referred to as &quot;closed&quot;). NPM is still their own company for now and that&#x27;s why the language is future tense.

yarn v1+ or yarn v2&#x2F;berry?Switching to berry has been a huge PITA over here, but I don&#x27;t want to give up workspaces

I suspect you&#x27;re still using the npm repository though? That&#x27;s the actual &#x27;valuable&#x27; thing that NPM (the company) makes.

NPM is a lot more than the CLI. Even if you use yarn as the CLI you are still using npm for hosting and all the other parts that don&#x27;t run on your computer. You can run your own npm repo, but hardly anyone does for all their dependencies (not talking about just caching here).I&#x27;d wager most people who use yarn even installed it via the npm CLI.

I am glad that the npm team will finally have some adult supervision.Meanwhile, I almost have my team switched to yarn.

Yeah, I was confused when I first heard of it because it seems like an odd couple to &quot;join&quot; one another.  However, it makes perfect sense for github to purchase npm.

&quot;Github acquires npm&quot; would be a better title IMO.

Interesting transitive ownership&#x2F;dependencies here.

I did not see that coming. I trust Microsoft to be able to offer great availability and nice software. It is maybe not the best overlord we could have hoped for but it&#x27;s way better than the status quo.

How does this acquisition relate to Package&#x27;s support of npm artifacts? Or, I guess, how will Package&#x27;s npm support change after this?

Can I be so bold as to suggest a new feature?It&#x27;d be wonderful, as a package consumer, to have visibility into some security metrics for a given package. This would be useful both at initial install time, and when the package is upgraded. Something like:1) who are the latest commits GPG signed by?2) is the package publisher using 2FA?3) what is the security profile of all dependent packages?4) are there any new authors (directly or via dependencies) since the last version (with links to the author and their contributions).These might help avoid prior situations where popular packages get injected with malware by new maintainers.

Slightly OT: Is Packages coming to Azure DevOps Server (local&#x2F;corporate hosted)?

Part of GitHub (I work at GitHub and lead the Packages team)

Wait, so is it joining Microsoft? Or is it under Github, which is under Microsoft?I don&#x27;t fully understand the way it&#x27;s governed from this article.

I can&#x27;t speak to company internals, but I do know that Azure is powering GitHub Actions runners, and there have been a firehose of new features coming out of GitHub in the past year. I imagine its pretty core to their &quot;Developers Developers Developers&quot; strategy.

GitHub employees have access to Microsoft internal tools and a Microsoft email address, so I don&#x27;t think there&#x27;s too much internal firewalling.

It&#x27;s totally the smart thing to do. Github needs a ton of cloud compute with github actions, Azure powers it. Github brings a very strong brand that developers love, which gives Microsoft a good rep amongst technical folks.This is as good as Google acquiring Youtube because Youtube needs an insane amount bandwidth and it was a perfect fit for Google&#x27;s infrastructure and ad platform.It&#x27;s just sad to see Google not playing the Developers game well.

Do you think they&#x27;re going to try and push us towards azure more, or force us into using Microsoft logins?

I&#x27;ve been at GitHub for 7 years and we operate independently but have the support and resources of Microsoft when we need them. IMO, they&#x27;ve been amazing partners but day to day the GitHub team builds, prioritizes, and supports GitHub.

I occasionally forget that Microsoft bought GitHub. They certainly don&#x27;t do anything here to remind me of that fact.How separate from MS has GitHub been in day-to-day operations?

In fairness to Microsoft, they did at least spend a little bit of time considering &#x2F; working toward maintaining the runtime part, before deciding otherwise <a href="https:&#x2F;&#x2F;github.com&#x2F;nodejs&#x2F;node-chakracore&#x2F;issues&#x2F;628#issuecomment-586139750" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;nodejs&#x2F;node-chakracore&#x2F;issues&#x2F;628#issueco...</a>

to be clear, Chrome&#x27;s overall value to Google probably dwarfs all those things combined.

They could fork it, the core of the runtimework is moving to WebAssembly anyway which is a much more tractable problem. Sure this is a boatload of JS work to do at the interface boundary but the amount of hard compiler and jit work that needs to be focused on by main runtime is much lower.Someone at MS knows strategic and tactics. When MS and Windows bootstrap themselves into the cloud, they will have some software to land on.

One could argue that the IE6 of our times is Google Chrome at this point..

I think it&#x27;s important to remember that IE6 was an amazing browser when it was first released.The problem is that it was left to stagnate after Microsoft won.

Yes, they almost own the entire JS ecosystem at this point.They lost a decade of battles for the web, but it seems they just found a way to get back in the fight.Now at the IE 6 times, that meant monopoly, and it was terrible news.But today, it means more competition between the giants, which is very good for us.

These tools are worthwhile additions. Vscode is a important toolkit item for many. Just having it on multiple platforms is a useful common denominator that reduces friction.

To be honest I like this new Microsoft. VSCode is a really good tool, C# is amazingly performant and they don‘t talk quite the same BS lingo as some other big players. Also MS research produces some really good stuff.

Also the new Chromium Edge is making its way. This will give some leverage on the browser front too.

Let&#x27;s not forget electron, atom and a few other things...

VsCode, Typescript, Github, NPM.And Microsoft doesn&#x27;t even have to maintain the main runtime, Google does.
What a clever strategy!

No, NPM the company is being acquired by Github.

It&#x27;s on there already. <a href="https:&#x2F;&#x2F;github.com&#x2F;npm&#x2F;" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;npm&#x2F;</a> and <a href="https:&#x2F;&#x2F;github.com&#x2F;npm&#x2F;cli" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;npm&#x2F;cli</a>

This kind of consolidation is probably not good for everyone who depends on open source projects. Microsoft now owns a significant portion of software distribution.

Microsoft turned their reputation around in recent years with developers but I wonder how long it will last.

no, this is microsoft &quot;embracing&quot; (buying control of) a huge point of centralization in a software distribution ecosystem, positioning them to have greater power over a huge number of developers.

i think so. the words &quot;put npm out of its misery&quot; come to mind.

Is this a too big to fail kind of charity acquisition?

My understanding was that financially they were not going to last long doing what they were doing.

Couldn&#x27;t be subsidized by VC money forever.

Maybe it needed to go somewhere to pay bills, or provide upside to the options holders.

it was default going out of business so yes this saved it from death

Am I weird for thinking it didn&#x27;t need to go anywhere?

I understand some folks trepidation but where was npm going anyway?

It does have a bit of a &#x27;value add&#x27; feel to it.But, you know, we&#x27;ve had decades of companies whose &#x27;business model&#x27; is just their exit strategy...

I would expect that moving git repos is easier than replacing NPM?

Yes, indeed - and the dependency is literally right there on the technical level. For years, you&#x27;ve been able to specify a version of a package as a github repo&#x27;s branch HEAD.npm i some-package username&#x2F;repo#branchName

It was already consolidated. The vast majority of public npm packages are already hosted on Github. The dependency on them has been there since the beginning.

Exactly, especially given the instability over at NPM. Hopefully MS &#x2F; Github can be a stabilizing influence both financially and culturally.

You aren&#x27;t the only one. Most users are too young to understand how predatory Microsoft has always been. Can&#x27;t wait for the &quot;npm won&#x27;t publish my package because it circumvents something in Windows&quot; or whatever. Give it time.

Then you must not like React or Angular, since the owners of those projects are the largest spyware and aggregators of personal data in the history of humanity.

It depends on what the alternative is. When NPM starts running out of money to run the service what would happen? More VC, but only to a point and the firms would be increasingly be influencing NPM to make money by any means(probably not good for anyone but the firms). Alternatively a cash strapped NPM fails to invest in security and availability of the service leading to widespread outages or worse a large scale supply chain attack facilitated via the registry.

What&#x27;s the specific outcome you&#x27;re concerned about?

I do not consider the largest distributor of proprietary, closed-source spyware (Windows) owning the fastest growing open source package manager to be a good outcome, personally.

given the significant returns to scale in the tech industry this is a pretty natural development and it happens in most tech sectors over time as monopolistic competition generally outperforms the &#x27;bazaar&#x27; economy.&#x27;small business&#x27; is only the equilibrium in sectors that can&#x27;t increase aggregate output by growing or capital investment like say, the restaurant industry.

I&#x27;m not sure I like the continued consolidation of all things tech around just a few large companies.That&#x27;s generally not a good place to be.

Maven Central is no hosted by Apache for example.

For programming languages, there are several examples of commercially run package managers:<pre><code> - the Java&#x2F;Kotlin&#x2F;Scala ecosystem is based around maven central, which is run by Sonatype, Inc.
 - Go modules are hosted by Google. Previously, most libraries were hosted on Github
 - Rust&#x27;s crate index is on Github
 - The Docker&#x2F;Moby registry is run by Docker, Inc. (though that might be a stretch for &quot;package manager&quot; :))</code></pre>

Confused why you think a service servings millions or billions of requests a day wouldn&#x27;t require money to run. Do you think some grant magically appear out of thin air to pay for the servers, storage, bandwidth, and maintenance?

PyPy runs on donated infrastructure that costs over 800K&#x2F;month in hosting costs[1].Not many non-commercial entities can afford that.[1] <a href="https:&#x2F;&#x2F;twitter.com&#x2F;dstufft&#x2F;status&#x2F;1236331765846990848" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;dstufft&#x2F;status&#x2F;1236331765846990848</a>

&gt; NPM being such an important pillar in the software supply chain while having an unviable business model and largely being funded by VC money was never a good position to be in.Why does NPM need to be funded as a commercial entity at all? What other open source library has a private company running its package manager? This one still boggles my mind.

&gt; Microsoft bought Github, then NPM... and the community is celebrating both of those things??I don&#x27;t think you could honestly say the community celebrated both of those things.

I&#x27;d really love to teleport some forum nerd from just six years ago to the present.- Microsoft is a leading sponsor of open source?- In fact, .NET is open source now and runs on Linux?- Microsoft bought Github, then NPM... and the community is celebrating both of those things??- The guy from the apprentice is what?

This seems like a good outcome overall. NPM being such an important pillar in the software supply chain while having an unviable business model and largely being funded by VC money was never a good position to be in. There are problems with more of the software ecosystem consolidating with a single entity but it still feels like an improvement.

There&#x27;s plenty of alternatives already so I don&#x27;t see MS being able to do anything untowards. &#x2F;shrugs, I&#x27;ll panic only if something bad happens.

I hope you&#x27;re spending lots of money at independent places then, because this is the inevitable result of the current &quot;OSS infrastructure funded by VC charity&quot; model. NPM was losing money, as was GitHub when Microsoft bought that. Under such conditions, getting bought out by a megacorp is the only path forward.

I worry that this is too much consolidation.

It&#x27;s confusing. RubyCentral pays for hosting and &quot;ops&quot; (not sure how much &#x27;ops&#x27; staff time, if any?), but I think not development? And RubyTogether hypothetically pays for development (some but not neccesarily all that&#x27;s needed), which can include new features but also required maintenance (we all know software requires care and feeding, it&#x27;s never &quot;done&quot;)?But I could have this not right?It has been confusing for a variety of reasons.And I think there are mixed reviews with how well it&#x27;s going overall, especially the RubyTogether part.

Thanks for that clarification, I was not aware of that. Thanks RubyCentral!

Just to clarify, RubyCentral <a href="http:&#x2F;&#x2F;rubycentral.org" rel="nofollow">http:&#x2F;&#x2F;rubycentral.org</a> is running the RubyGems registry.

Reminds me of what happened with Cloud9 and VS Code. First, Cloud9 was awesome for allowing devs to code remotely. Then once VS Code became the best editor out there, they added remote host support (among other things) and now Cloud9 caters to a different audience entirely.

It is exciting to see that having everything in a single application is being validated by GitHub. Last year it was very clear they are switching from a marketplace model to a single application by including Verify (CI), Package, and Secure.We think Git(Lab|Hub) will become the two most popular solutions and we look forward to this competition <a href="https:&#x2F;&#x2F;about.gitlab.com&#x2F;handbook&#x2F;leadership&#x2F;biggest-risks&#x2F;#competition" rel="nofollow">https:&#x2F;&#x2F;about.gitlab.com&#x2F;handbook&#x2F;leadership&#x2F;biggest-risks&#x2F;#...</a>I think the companies that should be nervous are ones that have only one stage or ones that have multiple stages but as a suite of applications instead of a single application <a href="https:&#x2F;&#x2F;about.gitlab.com&#x2F;handbook&#x2F;product&#x2F;single-application&#x2F;" rel="nofollow">https:&#x2F;&#x2F;about.gitlab.com&#x2F;handbook&#x2F;product&#x2F;single-application...</a> There are a lot of these <a href="https:&#x2F;&#x2F;about.gitlab.com&#x2F;devops-tools&#x2F;" rel="nofollow">https:&#x2F;&#x2F;about.gitlab.com&#x2F;devops-tools&#x2F;</a>

It is important to understand that the &quot;one single workflow&quot; was very much what VSTS (Microsoft&#x27;s GitHub competitor before they bought GitHub) was providing. It is very evident that Microsoft&#x27;s enterprise background is shaping how GitHub is evolving.GitHub is now very much focused on the end to end life cycle now that they have &quot;GitHub One&quot;.

That must make you nervous over at GitLab, no? GitLab&#x27;s integrated workflow is one of its main selling points (I love it), and GitHub now seems to be well underway to cross that moat.

Thanks to Microsoft&#x2F;GitHub for this acquisition. NPM is essential to the Javascript eco-system and it is hard to have a business model for just a registry. In the ruby eco-system the awesome Ruby Together <a href="https:&#x2F;&#x2F;rubytogether.org&#x2F;" rel="nofollow">https:&#x2F;&#x2F;rubytogether.org&#x2F;</a> was started to run the registry. In this case one of the worlds most valuable companies will run it, which means it doesn&#x27;t need a not-for-profit.Regarding &quot;trace a change from a GitHub pull request to the npm package version that fixed it&quot; will there be an API to add a source in case the change was made outside of GitHub? Although I recognize that the vast majority of changes to npm packages happen on GitHub.

... and everyone knows that big corporations always speak purely from their open heart when they sign large acquisition deals.

I mean. It&#x27;s a subsidiary. I understand your sentiment but mentioning Microsoft would be like signaling that GitHub doesn&#x27;t have any autonomy which is quite the contrary to what Microsoft said when buying it. So don&#x27;t expect sudden sincerity on this. There&#x27;s a reason why they haven&#x27;t added Microsoft branding to areas like the footer.

Um, no you didn&#x27;t. It only works with windows 10<a href="https:&#x2F;&#x2F;docs.microsoft.com&#x2F;en-us&#x2F;windows&#x2F;wsl&#x2F;wsl2-install" rel="nofollow">https:&#x2F;&#x2F;docs.microsoft.com&#x2F;en-us&#x2F;windows&#x2F;wsl&#x2F;wsl2-install</a>

Actually it is a return to their roots, given Xenix.

You do remember one of the original Windows NT subsystems was OS&#x2F;2 1.x, right?
<a href="http:&#x2F;&#x2F;www.os2museum.com&#x2F;wp&#x2F;nt-and-os2&#x2F;" rel="nofollow">http:&#x2F;&#x2F;www.os2museum.com&#x2F;wp&#x2F;nt-and-os2&#x2F;</a>
And look how that turned out :)

I installed Windows Subsystem for Linux 2 on an older machine just now. The MSFT of today is definitely a far cry from the MSFT of yesteryear. Such a thing would have been unheard of 15 years ago.

Sleez&#x27;n their way into our hearts. I can&#x27;t say I really blame them, but god I hate it all.

I get this in principal, but when I go to GitHub without being logged in it just feels... well, like Microsoft.

Microsoft is aware of their reputation. So much that they even have a policy of not allowing Microsoft+Github co-brand promotions. They want the Github brand to stay strong instead of being diluted into some mix of Github and Microsoft.

I think they view it as way to make Core more reliable. Core relies community developed - npm hosted - tools like gulp and webpack. Unlike the full Framework, Core doesn&#x27;t have &quot;built-in&quot; or &quot;endorsed&quot; bundling solution.

Product Manager at GitHub here - I&#x27;ll be the Product Manager for npm when the acquisition closes. I agree - npm is definitely an integral part of the JavaScript ecosystem. The npm package registry will remain free for public projects. We&#x27;re going to work to ensure that the service is stable and accessible, and ready to serve the next million packages.This is independent of what Microsoft&#x27;s doing with .NET Core. I&#x27;m excited about the work that they&#x27;re doing, but this isn&#x27;t going to stop us from making sure that npm is outstanding.

My fear might probably be unfounded, but NPM is an integral part of the JS ecosystem. And given MicroSoft has .NET Core, I have a strange feeling that they&#x27;ll concentrate on npm less.

The latter already happened[1]. Bayer offloaded most of it&#x27;s ag business (to BASF) and replaced it with Monsanto. Monsanto has been rebranded &quot;Bayer Crop Science&quot;. Although I&#x27;m guessing much for the same reason, Monsanto never rebranded any of the dozens of seed companies it acquired over the years (e.g. Dekalb, Seminis, Asgrow, etc.)The same also goes for Charter → Spectrum.[1] <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Monsanto#Sale_to_Bayer" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Monsanto#Sale_to_Bayer</a>

And I was wondering what was going through Facebook&#x27;s mind when they decide to have Instagram &#x2F; WhatsApp by Facebook Brand.

I&#x27;m surprised there&#x27;s not a single mention of &quot;Microsoft&quot; in this or the npm announcement [1], given the old-evil-history of Microsoft and the new-nice Microsoft we have today.Maybe Microsoft&#x27;s reputation is exactly the reason why it was left out of this announcement.Sometimes a brand is so tarnished that the owner tries to hide it from the people who hate it. (For example, Comcast → Xfinity. I expect Monsanto to go the same way and become Bayer.)

My first reaction was ... “so Microsoft”. I’m with you on the positive path Microsoft have been on with OSS but also recall the not-so-recent history. It’ll be interesting to see how this plays out.

Git was designed to be decentralized from the start. Is there a way to revitalize that heritage?Discoverability and pull requests are two big benefits that GitHub has offered. Could we create decentralized open source solutions to provide those benefits? Are there other benefits that we’d need to provide to have viable alternatives to centralization?

Microsoft wants to host as much information as possible so it can collect data on developers and users. It is very hard to avoid giving data to Microsoft. GitHub, NPM, LinkedIn, Office 365, Teams, the lock-in is still alive.A decentralized web or a non-for-profit like Wikipedia is a much better model for these infrastructure projects.

Would be super strange if titles always referred to the top-most parent company. Every time Google does something the title should be referring to Alphabet? Please no.

Yes, why is this not titled &quot;Microsoft acquires npm&quot;?

Yup, currently MacOS is still better IMO for web development but I really would like MS to improve on that regard.

This is great news for people forced to use Windows. JavaScript being a 1st class citizen on MS platforms is being even more cemented. It&#x27;d be great if Microsoft moved faster with Python integration into the MS ecosystem like SQL Server.

&gt; considering the reason that most modules in npm are still in ES5 is exactly because of the monopolistic practices that Microsoft followed back in the day which makes Internet Explorer still relevant.Could you tell me more about that?

Microsoft bought Github less than 2 years ago.

Microsoft acquired GitHub.<a href="https:&#x2F;&#x2F;news.microsoft.com&#x2F;2018&#x2F;06&#x2F;04&#x2F;microsoft-to-acquire-github-for-7-5-billion&#x2F;" rel="nofollow">https:&#x2F;&#x2F;news.microsoft.com&#x2F;2018&#x2F;06&#x2F;04&#x2F;microsoft-to-acquire-g...</a>

I don&#x27;t follow.Why would there be a mention of Microsoft? That many modules in npm are ES5 is completely irrelevant for npm&#x27;s purpose.And Microsoft changed, how exactly?And why are you advertising for them?

I&#x27;m surprised there&#x27;s not a single mention of &quot;Microsoft&quot; in this or the npm announcement [1], given the old-evil-history of Microsoft and the new-nice Microsoft we have today.I would expect that there was at least a mention, considering the reason that most modules in npm are still in ES5 is exactly because of the monopolistic practices that Microsoft followed back in the day which makes Internet Explorer still relevant.Not negative, not positive comment. Just surprising there was no mention. And I do think Microsoft is doing a great job recently with Open Source in general.[1] <a href="https:&#x2F;&#x2F;blog.npmjs.org&#x2F;post&#x2F;612764866888007680&#x2F;next-phase-montage" rel="nofollow">https:&#x2F;&#x2F;blog.npmjs.org&#x2F;post&#x2F;612764866888007680&#x2F;next-phase-mo...</a>

Interesting subtle implications that the NPM paying users are going to be moved to Github&#x27;s distribution system, while maintaining the OSS version of NPM for everyone else.

I&#x27;m not liking the consolidation. Never ends well, ever. Not even in one case in the history of humanity.I&#x27;ll be switching from Github to other providers for my own projects, and use a different editor soon (using vscode now).

They do and I will give them props for that. But no company should have as much control over open source that Microsoft does.

Indeed, these two projects alone have turned around my long-held opinion on Microsoft, to &quot;cautiously optimistic&quot;.TypeScript and VS Code have been an invaluable contribution to the community. I&#x27;m a daily user of both and so thankful for the talent, ingenuity and effort that have gone into them.How Microsoft have managed the acquisition of GitHub, giving them autonomy and infrastructure support - so far, it&#x27;s been all around positive.Now with NPM under their wings, the centralization does worry me somewhat. I hope there are conscientious decision-makers who will guide the project for the good of community and ecosystem.

They should get props for TypeScript &amp; VSCode.

Gotta respect how Microsoft couldn&#x27;t build anything the open source community wanted to work with&#x2F;on so instead they used their Windows and Office monopoly to buy everyone&#x27;s favorite playgrounds.

Thank god. NPM is so crappy it desperately needs institutional support.

I mean, what would normally happen is employees look for new jobs, equipment is sold, and tech is thrown away (or open sourced in rare cases). Doesn&#x27;t this already happen all the time?

What would happen to all the tech, equipment, and employees after the company goes out of business? We have to burn it?If we did that, it would be a crazy waste of resources. The alternative is to let another company buy the stuff... and if a company buys the failed company&#x27;s tech, equipment, and hires their staff... that is basically the same as buying the company.

&lt;tangent&gt;Sometimes I wonder what the business world (and the internet) would be like if mergers and acquisitions weren&#x27;t allowed. Like, if businesses had to be sustainable or they&#x27;d just die, rather than capturing a whole market while eating VC money, maybe we&#x27;d all be better off? All of the really embarrassing stuff coming out of SV would just go away? Just Pinboards and Sourcehuts and Mastodons ruling the web?I&#x27;m capitalistically illiterate, so somebody please tell me why this thought is stupid.

Am I the only one surprized that there&#x27;s an npm Inc. to be acquired?Why is there a for-profit corporation behind every open source project these days?

Microsoft does have a much better track record in terms of keeping their products alive than other Way Way Large companies that could have made this acquisition, and for that I&#x27;m pretty glad.That said, and just in case their notoriously warlike legal team manages to fumble this somehow, I&#x27;d like to take the opportunity to remind every other frontender that Verdaccio (<a href="https:&#x2F;&#x2F;verdaccio.org&#x2F;" rel="nofollow">https:&#x2F;&#x2F;verdaccio.org&#x2F;</a>) exists, is easy to implement, and relatively low maintenance.

NPM&#x27;s blog post: <a href="https:&#x2F;&#x2F;blog.npmjs.org&#x2F;post&#x2F;612764866888007680&#x2F;next-phase-montage" rel="nofollow">https:&#x2F;&#x2F;blog.npmjs.org&#x2F;post&#x2F;612764866888007680&#x2F;next-phase-mo...</a>

Yarn is majorly only a CLI. It still uses NPM as the source for most packages.The product Github is probably most interested in is NPM as a repository for packages, not its CLI.

Sorry, but npm burned me too many times. It is (was?) the worst package manager I&#x27;ve ever used. Not a fan of npm the company either. I&#x27;m sticking with yarn.

Yes, I love those.  We&#x27;ll keep those around for sure.

Damn, someone just beat me to &quot;Now Part of Microsoft&quot;<a href="https:&#x2F;&#x2F;github.com&#x2F;npm&#x2F;npm-expansions&#x2F;pull&#x2F;2936" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;npm&#x2F;npm-expansions&#x2F;pull&#x2F;2936</a>

Most important question: Will you still be able to see user-submitted phrases explaining the npm acronym? (See upper left-hand corner of <a href="https:&#x2F;&#x2F;www.npmjs.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.npmjs.com&#x2F;</a>)

I am honestly amazed that there is no official way to install Fedora or Fedora CoreOS on GCP. There are no images even on the GCP marketplace.Stuff like this is what irritates me. Even small vps providers have this.

I honestly think that Google cloud platform will be shut down within a couple years. It seems like it’s losing the war very badly.

Just like GitHub this is a cloud play to make Azure more appealing by meeting developers where they&#x27;re at, increase dev mindshare&#x2F;reach, hosting their packages, CI Scripts&#x2F;Actions then making it seamless to deploy to Azure.Smart, have no idea where AWS or GCP&#x27;s control team are at when these strategic plays are going down.

A special day. The stock market is down 388% and 142% of people are predicted to die, but I got Internet karma points for guessing something right and that&#x27;s what really counts.

Neat contribution! You guessed one thing, someone else guessed another, but they were wrong, and you were right! Yay on @pavlov. Boo on them.

I used to be excited when I made predictions like that. Then I realized that my correct predictions, plus $4.15, would only get me a Venti Latte at Starbucks.

Heh, I called this 10 months ago:<a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=19838122" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=19838122</a>Somebody replied &quot;Microsoft won&#x27;t acquire npm for sure.&quot;

This is pretty great. NPM was struggling to monetize and is a critical part of the JavaScript ecosystem.

Does this mean using alternatives (GitLab, et. al) is not an option?The worst option has been Elm&#x27;s system where the whole package system requires you to not only use GitHub, but when GitHub in down (which isn&#x27;t uncommon unfortunately) packages that weren&#x27;t cached locally were inaccessible with no mirroring options.

Yes thank you! We believe namespaces are a good thing and will continue to promote it as best practice.Hopefully we can integrate repository information to packages meta data such that you could be aware of a change of ownership even for a globally namespaced package.

I think this is the big reason I&#x27;m excited about NPM joining GitHub. I don&#x27;t trust NPM (I&#x27;m not fond of package repos in general), but tying packages closely to their GitHub source offers significantly more verification potential that a package is in fact comprised of the source code for it, and that it hasn&#x27;t recently turned hostile.

I hope this doesn&#x27;t alter the current GitHub npm package registry policy where all packages must be published under a scope corresponding to name of the owning GitHub user&#x2F;org. The resulting increased transparency and clarity of ownership will be great for the JS ecosystem.The existing npm ownership model is markedly less clear and has led to several problems, including the transfer of package publishing rights to bad actors without anyone being aware. On the whole, npm accounts and orgs were always just an unnecessary abstraction that obscured the actual provenance of software, of which GitHub is the de facto source.

NPM is joining GitHub, GitHub joins Microsoft, Microsoft joins... ;)

Time to get behind Deno<a href="https:&#x2F;&#x2F;en.m.wikipedia.org&#x2F;wiki&#x2F;Deno_(software)" rel="nofollow">https:&#x2F;&#x2F;en.m.wikipedia.org&#x2F;wiki&#x2F;Deno_(software)</a>Built by the node team to replace node.

I too was curious about how much the acquisition cost. According to TechCrunch:&gt; GitHub, the developer repository owned by Microsoft, made a little deal of its own this morning when it bought JavaScript packaging vendor npm for an undisclosed amount.<a href="https:&#x2F;&#x2F;techcrunch.com&#x2F;2020&#x2F;03&#x2F;16&#x2F;github-nabs-javascript-packaging-vendor-npm&#x2F;" rel="nofollow">https:&#x2F;&#x2F;techcrunch.com&#x2F;2020&#x2F;03&#x2F;16&#x2F;github-nabs-javascript-pac...</a>

How much did Microsoft pay? What did the founders take away?Most people don’t know, in these open source acquisitions by for profits there’s money involved and “founders” get an exit. Not always clear To the public who those are or what they took home from a mostly volunteer effort.

Minecraft for Linux does not have the same features.

Skype returned with a Linux client, and Minecraft never dropped Linux support at all.

Hopefully they don&#x27;t drop Linux support like they did with Skype, Minecraft, Xamarin[1], Corel Office and a long list of products.Their strategy from my perspective is to ensure Linux does not become a competitor for their desktop OS.1: it never had Linux support.

I see this as a straightforward play, simply put, I think (to summarize, perhaps a little to broadly)- They want to sell Azure Services- Most (if not all) NPM packages already live on github- NPM has a business revolving around package management, including private npm instances and increasingly around node&#x2F;package security- This being primarily a business that will sell to has-money businesses (e.g., medium to large businesses, Fortune 500 corporations etc)So, given all of the above, it makes sense to have a vertical selling into one of the fastest growing package management ecosystems where you can be the &quot;full stack&quot; provider of developer&#x2F;enterprise tools.I don&#x27;t think its anything beyond this, personally. I expect to see a lot of pushes to integrate with Azure Pipelines, cloud deployment etc. centered around this.I wonder if they&#x27;ll buy Passenger[0] next, its a popular (in my experience) to deploy nodejs applications.[0]<a href="https:&#x2F;&#x2F;www.phusionpassenger.com&#x2F;library&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.phusionpassenger.com&#x2F;library&#x2F;</a>

Github announced the Github packages feature a while back, but without npm it didn&#x27;t quite make sense. Acquiring npm means github not only hosts source code, but packages as well. With Github Actions, they want to be the one stop shop for code lifecycle and be at the forefront of javascript ecosystem.If developers love Github, they love the cloud. Microsoft is betting big on the cloud, they lost the Mobile war but they definitely want to be the developer and cloud darlings.

The thought that&#x27;s going into Deno about permissions and upstream package issues have me considering it where I&#x27;ve generally rejected node.js for anything serious (also recognizing that it&#x27;s probably early for production use).

Node+NPM isn&#x27;t going anywhere, but Deno sure seems like the server based runtime of the future.

Deno truly seems interesting. Especially native TypeScript ability.Who is backing the project in this point?

I wonder if more people will look into adopting Deno[1], the new node alternative by one of the creators of Node. It does not use NPM, you pull in packages Go-style (via URLs[2]). It&#x27;s supposed to be more secure because you have to explicitly give it access to anything (i.e. network, file system, etc).[1] <a href="https:&#x2F;&#x2F;deno.land&#x2F;" rel="nofollow">https:&#x2F;&#x2F;deno.land&#x2F;</a>[2] example import in Deno:<pre><code> import { serve } from &quot;https:&#x2F;&#x2F;deno.land&#x2F;std@v0.36.0&#x2F;http&#x2F;server.ts&quot;;
</code></pre>
Previous HN about Deno: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=22102656" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=22102656</a>

Does typescript support pnp somehow now?  (That&#x27;s actually the thing I&#x27;m wanting ...).  npm&#x27;s cli going away was an attempted tease (in bad-taste i think)

There already is a Yarn v2: <a href="https:&#x2F;&#x2F;dev.to&#x2F;arcanis&#x2F;introducing-yarn-2-4eh1" rel="nofollow">https:&#x2F;&#x2F;dev.to&#x2F;arcanis&#x2F;introducing-yarn-2-4eh1</a>

(Wishful thinking ...) Does this mean the next release of npm will be yarn v2 and that typescript will implement support for the pnp spec so we can converge the javascript packaging space to a sane place?

Neither side is announcing a price and NPM has been struggling financially for a while, so the likelihood that it was a &quot;good exit&quot; is low.

Not sure how good an exit it was. Crunchbase says they have fewer than 50 employees [0], so I&#x27;m guessing the first 10 people did pretty well but that the rest got what amounts to a nice bonus.Keeping the lights on long enough makes this kind of exit more likely. Paul Graham has a good article about this: <a href="http:&#x2F;&#x2F;www.paulgraham.com&#x2F;die.html" rel="nofollow">http:&#x2F;&#x2F;www.paulgraham.com&#x2F;die.html</a>NPM did better than &quot;just&quot; keeping the lights on, though. They even held Yarn at bay by adopting its best features very quickly.[0] <a href="https:&#x2F;&#x2F;www.crunchbase.com&#x2F;organization&#x2F;npm" rel="nofollow">https:&#x2F;&#x2F;www.crunchbase.com&#x2F;organization&#x2F;npm</a>

Here&#x27;s what isaacs writes in the NPM blog post (<a href="https:&#x2F;&#x2F;blog.npmjs.org&#x2F;post&#x2F;612764866888007680&#x2F;next-phase-montage" rel="nofollow">https:&#x2F;&#x2F;blog.npmjs.org&#x2F;post&#x2F;612764866888007680&#x2F;next-phase-mo...</a>). It doesn&#x27;t seem like anyone on the NPM team did great financially from this:&quot;I have a set of goals that I wrote down back then, and have shared openly with the team....3. Get a big enough exit that I can quit my job and see what comes out of me a second time.
4. Share the rewards equitably with the people who got npm to where it is....On (3), well, I’m still working a jobby job, but I always knew that was a long shot, and “make npm a better package manager” is a job I enjoy. And as for (4), I’m proud of the deals that we’ve been able to negotiate for the team.It’s not a kajillion billion dollar 10x startup cinderella story, and we’ve taken our hits, but in the end we’ve done right by our community, team, and careers, and I’m extremely proud of what we’ve achieved.&quot;

Assuming this was an acceptable exit: I&#x27;m impressed that NPM pulled this off. They were basically doing the &quot;no revenue model to speak of, hope we&#x27;ll get acquired by a bigco&quot; startup play that was starting to go out of vogue already when they were founded.I wonder to what extent they&#x27;ve had influence over their own success at all though. Basically they had to hope that JS stayed popular (it did), that Node stayed relevant (it did) and that the entire JS ecosystem would move over to NPM (it did, but I&#x27;d say rather despite NPM than because of it) (I mean, otherwise Yarn wouldn&#x27;t even exist, right?).So basically their bet was:- Turn NPM into a startup- Keep the lights onI bet I&#x27;m missing all kinds of key behind-the-scenes stuff, but still, I don&#x27;t know many startups that manange to successfully exit by &quot;just&quot; keeping the lights on. In a weird cringey way, it&#x27;s motivating.

I hope it&#x27;s not going to do a left-pad fiasco on everything in github.

Mid Oct 2009 -- Github ceased gems.github.com to focus on source control

I&#x27;d like to see Microsoft bring Ryan Dahl (original author of node) back in the fold by sponsoring&#x2F;buying Deno with TypeScript. It&#x27;s a good fit.

Current me loves this, and I love all the GitHub tools they&#x27;ve added recently.Future &quot;5-10 years down the road&quot; me knows this will suck, ending up where all concentrated monopolies end up...

Ok now Microsoft just needs to acquire what remains of Docker and their Developers, Developers, Developers, Developers collection will be complete.

Second this. It still seems to be working fine... (actually, better than npm last I checked)

The maintainer released Yarn 2. Yarn 2 is pretty foundationaly different than Yarn 1, and can and does break a lot of products&#x2F;projects if used. Some folks are not happy about it, although Yarn 1 will probably continue to be maintained by the community for a while.This seems to be pretty fair about the whole thing: <a href="https:&#x2F;&#x2F;shift.infinite.red&#x2F;yarn-1-vs-yarn-2-vs-npm-a69ccf0229cd" rel="nofollow">https:&#x2F;&#x2F;shift.infinite.red&#x2F;yarn-1-vs-yarn-2-vs-npm-a69ccf022...</a>

&gt; after we saw what happened to yarnI missed something, what happened to Yarn?

Embrace, Extend, and Extinguish:&gt; &quot;Embrace, extend, and extinguish&quot; (EEE), also known as &quot;embrace, extend, and exterminate&quot;,is a phrase that the U.S. Department of Justice found was used internally by Microsoft to describe its strategy for entering product categories involving widely used standards, extending those standards with proprietary capabilities, and then using those differences in order to strongly disadvantage its competitors.<a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Embrace,_extend,_and_extinguish" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Embrace,_extend,_and_extinguis...</a>

Embrace, extend, and extinguish<a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Embrace,_extend,_and_extinguish" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Embrace,_extend,_and_extinguis...</a>

You know what they say ... there is no I in EEE.

&gt; Google and Amazon have the EEE under lock right nowwhat is EEE?

I think the poster was saying that .NET has a dev strategy, but other projects don&#x27;t.&gt; Microsoft can’t even put coherent dev strategy outside of .NET on Azure

The flip flopping between Metro &#x2F; Windows 8 &#x2F; UWP permanently turned me from doing anything non-win32-API on Windows again.

What&#x27;s wrong with Microsoft&#x27;s dev strategy? .NET continues to be the most powerful and productive platform that I&#x27;ve used..NET Core was a great move and it&#x27;s all coming together nicely now, and even creating innovations like Blazor.

They’re likely not supposed to be commenting on things like this as an active employee of the company in question.

I’m not sure how you made out Microsoft to be anything but a benevolent ruler here, “throw away for obvious reasons” seems like a weird thing to say

Counter thesis: what &quot;killed&quot; Atom is the balance of user enthusiasm quickly shifting to VSCode. Well before the acquisition was even announced, VSCode started grabbing developer mindshare real, real fast. I remember being an Atom user who resisted that tide for a while, but it became pretty clear that VSCode was taking off like a rocket and Atom, well, wasn&#x27;t.If commit activity graphs are really a meaningful measure, look at VSCode&#x27;s:<a href="https:&#x2F;&#x2F;github.com&#x2F;microsoft&#x2F;vscode&#x2F;graphs&#x2F;commit-activity" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;microsoft&#x2F;vscode&#x2F;graphs&#x2F;commit-activity</a>The number of commits per, uh, date unit (the graph is not super clear on that axis, honestly) across the entire length of VSCode&#x27;s activity graph rarely drops as low as the highest number of commits per date unit for Atom.I&#x27;d have preferred to see both survive and do well, but that really hasn&#x27;t been the way the text editor space seems to have worked. Editors that are conceptually awfully similar to one another tend to have one dominant player: TextMate (at least for Macs), then Sublime Text, then Atom, then very quickly Code. Given that Code and Atom are probably the closest of any two in that list, this just isn&#x27;t that surprising.

I switched from Atom to VSCode well before the acquisition, and I personally know many others that did too.What need does Atom fill that VSCode doesn&#x27;t?

Please not call MS &quot;killed&quot; atom. Even before MS acquisition Atom was clearly losing in the competition.

What killed atom was that not even with rewriting stuff in C++ they were able to match what Microsoft is able to do with pure JavaScript on Electron.Lack of delivery killed Atom, not Microsoft.

Maybe Microsoft helped killing Atom, but I don&#x27;t think Atom is completely innocent by itself.I was an user of Atom and later switched to VSCode. It took me few months of weighting all the options before I made the switch. That&#x27;s how much I love Microsoft -- Very little.Don&#x27;t know if they got it fixed, but there was a design flaw in Atom: Bug inside some Atom plugin (`linter-ui-default` is one of it if my memory is correct) can reset the entire Atom into it&#x27;s default setting, and it happens randomly (See link 1, 2 and 3).This problem pisses me off so much and so many times. The last time it happened, I accidentally deleted my backup configuration `config.cson` when trying to recover the setting. Yes, it is technically my fault, but no, really, it is not. So, after seeing all my life flashed before my eyes, I decided to stop living ... with Atom, I had enough.VSCode is generally a better editor when compare to Atom. I mean, VSCode has it own issues, sure. But for me, so far those issues are mild and usually got fixed quickly.1: <a href="https:&#x2F;&#x2F;github.com&#x2F;atom&#x2F;atom&#x2F;issues&#x2F;14922" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;atom&#x2F;atom&#x2F;issues&#x2F;14922</a>
2: <a href="https:&#x2F;&#x2F;github.com&#x2F;atom&#x2F;atom&#x2F;issues&#x2F;14909" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;atom&#x2F;atom&#x2F;issues&#x2F;14909</a>
3: <a href="https:&#x2F;&#x2F;discuss.atom.io&#x2F;t&#x2F;atom-keeps-losing-settings&#x2F;61617" rel="nofollow">https:&#x2F;&#x2F;discuss.atom.io&#x2F;t&#x2F;atom-keeps-losing-settings&#x2F;61617</a> (This one was in 2018 while the other two was in 2017)

&gt; Microsoft for all intents and purposes killed AtomI don&#x27;t think so. When VS Code came out my reaction was &quot;Wow! It&#x27;s like a 1.0 version of Atom!&quot; I.e. an electron (or similar) based editor that works, whereas atom always seemed like a beta release. I tried to use atom a bit but it came with little out of the box and the plugin ecosystem was a complete mess. I filed an issue asking if obsolete&#x2F;dead plugins could be somehow removed from the plugin repository, but nothing came of it.Atom wasn&#x27;t killed, it died on its own.

Given that Microsoft for all intents and purposes killed Atom (along with their really promising xray project [0]) almost immediately after the acquisition [1] even after explicitly claiming they wouldn&#x27;t [2], please excuse me for not seeing the GitHub acquisition in the same positive light.[0] <a href="https:&#x2F;&#x2F;github.com&#x2F;atom-archive&#x2F;xray" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;atom-archive&#x2F;xray</a>[1] They never officially announced it, but they almost certainly de-staffed it to the point where it&#x27;s barely on life support: <a href="https:&#x2F;&#x2F;imgur.com&#x2F;a&#x2F;jQBHsUk" rel="nofollow">https:&#x2F;&#x2F;imgur.com&#x2F;a&#x2F;jQBHsUk</a>[2] <a href="https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;AMA&#x2F;comments&#x2F;8pc8mf&#x2F;im_nat_friedman_future_ceo_of_github_ama&#x2F;e0a2b2e&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;AMA&#x2F;comments&#x2F;8pc8mf&#x2F;im_nat_friedman...</a>Update:What a surprise, the VSCode fanboys are coming in droves to downvote and say nothing more than how Atom was going to die anyways.Sure, maybe it was, but that&#x27;s not the point. The point is Microsoft _actively pulled development resources away from Atom after explicitly claiming they wouldn&#x27;t_.I get that a lot of people like VSCode better than Atom, but _please_ put things into perspective for a moment and consider if you&#x27;d make the same comment if the same thing happened to _your pet project that happened to be #2 in popularity but then got axed after being acquired by the company who owned the #1 after claiming they wouldn&#x27;t do exactly that_.Whatever your opinion might be on Atom vs VSCode, can we not at least agree that this kind of behavior is something we should hold acquiring companies accountable for? It might not make any difference to their bottom line at the end of the day, but the least we should do is hold them to the fire in the court of public opinion.

&gt; That&#x27;s what we said about the Skype acquisition too.“On 10 May 2011, Microsoft Corporation acquired Skype Communications, S. à r.l for US$8.5 billion”I think Microsoft has changed significantly in the last decade.I’m quietly hopeful the npm acquisition will go well for us (although I still hold some serious grudges about Microsoft’s past behaviour).

I&#x27;m not at Microsoft anymore but I was there when Skype got acquired and I had a bunch of friends who worked on it.You have to understand that the technology underlying Skype at the time was very brittle and poorly designed.Google almost bought Skype before Microsoft did and backed out after they got a look at the code.When Microsoft acquired it Skype was routing its traffic over port 80 for example.

My thoughts as well. I&#x27;ve been at Skype when it was still running semi autonomously, when I left we were part of the office organization.

i’ve been at three companies that acquired small shops. that 5y horizon to the kill-decision lines up with my experience. most recently i worked with a company (mid size) that had been acquired two years prior by a very large international organization. “its great, they let us do what we do best and are excited to adopt some of our practices”. Two weeks later the senior leadership was shuffled and the mothership was changing things to better match their process, etc.

Skype is crap, it was doomed to die around that time frame anyway. If anything, Microsoft Business kept Skype going longer than it would have otherwise.Seriously, go use products like Google Hangouts, Slack or Microsoft Teams (Microsofts&#x27;s surprisingly better clone of Slack) and then tell me that Skype was ruined by integrating with Microsoft&#x27;s other product base. The closest argument you might be able to make is that Skype could have developed new features or updated its UI and stayed competitive, but that wouldn&#x27;t give them the competitive edge that it&#x27;s competitors nearly all had in terms of being backed by major tech companies. Additionally, the major revenue source was Business tier use, which Microsoft dramatically improved by integrating it with their other cloud-based business suite applications.Microsoft didn&#x27;t kill Skype, if anything they extended its life expectancy and value in markets that actually paid to use it. It&#x27;s dead&#x2F;dying now because better tools have been developed and marketed to replace it. That&#x27;s just standard product life cycle.

&gt; Microsoft doesn’t do everything right but the GitHub acquisition has honestly gone better than I ever expected. Rather than forcing GitHub to adopt Microsoft centric policies, Microsoft has adopted more GitHub stuff, especially from a product POV. GitHub still runs as a separate company (different logins and health care and hiring systems) with its own policies and point of view.That&#x27;s what we said about the Skype acquisition too.&quot;It&#x27;s different this time, it will run independently, for once Microsoft won&#x27;t interfere and destroy the acquired company&quot;.3 years later (I was there), 50% of Skype original management and developers left. All the major new projects of Skype turn out to be integration with the endless already existing Microsoft products: integration with Link, integration with microsoft ID, integration with Microsoft UI, etc...5 years later, Skype is dead... but everyone left already.Good job Microsoft.

Ooh details please. I&#x27;ve looked at the docs but haven&#x27;t used actions yet. What makes it worse than circle?The initial capabilities look similar and circle really needs a competitor with how flaky their service has recently been.

The Github acquisition was pretty recent, no? It seems like Actions is something that Github would have planned and been working on for some time prior to that.

Really I feel competition with Gitlab which is pushing Github to do things like Actions that they should have done for a long time.

GitHub is still a good choice, but working with their more recent APIs, like GitHub Actions, I feel Microsoft&#x27;s touch. They&#x27;re slowly changing for the worst.

&gt; Microsoft is laughably incompetent at achieving that sort of strategy.If they did choose to EEE, this makes it more likely, not less.

Yarn&#x27;s new version does a bunch of weird, complex to reason about stuff that&#x27;s closer to a bundler than it is to a module manager: <a href="https:&#x2F;&#x2F;github.com&#x2F;yarnpkg&#x2F;yarn&#x2F;issues&#x2F;6953" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;yarnpkg&#x2F;yarn&#x2F;issues&#x2F;6953</a>

&gt; after we saw what happened to yarnWhat happened with yarn? As a very casual user of it, it seems to work well and have pushed npm to innovate a bit when it was stagnating. But I haven’t followed it lately. Were there technical issues or political drama?

No. Microsoft did not adopt to Github. The first thing microsoft did after acquiring github is forced to login to view commits. I felt like some huge corporation took over the park i daily visit and charged me. It felt terrible.

Microsoftie here — throwaway for obvious reasons.Microsoft doesn’t do everything right but the GitHub acquisition has honestly gone better than I ever expected. Rather than forcing GitHub to adopt Microsoft centric policies, Microsoft has adopted more GitHub stuff, especially from a product POV. GitHub still runs as a separate company (different logins and health care and hiring systems) with its own policies and point of view.The reality is npm was in a bad place and in a land of not good options, this strikes me as the best possibility. I’d rather have GitHub control this and be able to give the resources to npm than a company like Oracle or Amazon or even Google or Facebook to own it. In a perfect world, some independent entity could fund npm out of gratitude but at the same time, consider how poorly npm as a company was run for YEARS and the general lack of direction.So yeah, I’m cautiously optimistic this won’t be fucked up by GitHub — but I understand the concern.As for those worried about Microsoft embracing, extending, and extinguishing. Lol. Even if that was the goal (and I truly don’t think that’s the ethos at all any more), Microsoft is laughably incompetent at achieving that sort of strategy. Google and Amazon have the EEE under lock right now (Facebook too — let’s be glad Zuck didn’t buy this after we saw what happened to yarn), but Microsoft can’t even put coherent dev strategy outside of .NET on Azure.

in as much as I love Github, putting our eggs in one basket as developers is gonna burn us soon or later. we need redundancies in the system, that if one thing goes down, the world can go on as normal. now we&#x27;re centralizing github as a single failure point. we&#x27;ve already seen the the panic outages of Github or S3 cause.

I&#x27;m always worried when thing like this happen :Critical open source entities are bought by private company. I understand the need for money and sustainability these entities need, but it&#x27;s really a shame that the open source community doesn&#x27;t &quot;own&quot; themselves.

Microsoft owns so may day-to-day tools and platforms. LinkedIn, GitHub, NPM.

They could probably save tons just by deduping the npm and github homepages of every package!

Yay more centralization! What could possible go wrong with critical components being hosted by one big corporation?

title should be &quot;microsoft acquires NPM&quot;

this should really be titled &quot;npm is joining Microsoft&quot;

Who predicted it 5 month ago? hmm?<a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=21031266" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=21031266</a>I also predicted a few more controversial things but if you think it terms of ecosystem and cloud market strategy, then it makes perfect sense.

NPM Is Joining GitHub