The solution is to design package managers around the uniform resource identifier: a way to locate online assets that is mostly (ignoring DNS) decentralised and better than having one org own all the packages.

▲ notatallshaw 11 hours ago | parent | next [-]

Taking PyPI as a central place of packages, it is known that their bandwidth bill would be $1.8+M per month (https://dustingram.com/articles/2021/04/14/powering-the-pyth...) were it not for Fastly giving them a 100% discount.

Are there any reliable decentralized package distribution systems operating at within 2 orders of magnitude of that scale? How do they handle administrative issues such as malicious packages or name squatting? Standards updates? Enforcement of correct metadata? And all the other common things package indexes need to handle.

I'm clearly skeptical, but would be very interested in any real world success stories.

	▲	hellcow 11 hours ago \| parent [-]
		Go does this, and I’d say it’s been highly successful.

▲ cortesoft 12 hours ago | parent | prev | next [-]

You can absolutely use bundler and gem without touching the rubygems servers. You can point to an alternate rubygems host (including one you run yourself), point to a git repo, or a local gem file source

▲ rmoriz 12 hours ago | parent | prev | next [-]

This resembles the "monolith" vs "micro-services" discussion. If you spread the packages over thousands of domains, hosts, providers, reliability will be horrible. And it's uncontrollable. In theory, RubyGems could run code analyzers on all uploads to detected malware. Good look if you just haven an index of repositories/packages hosted elsewhere.

	▲	nenenejej 6 hours ago \| parent [-]
		Step 2: store a copy of the library in your repo. Sounds nut? We used to do this with .dlls in sourcesafe and was fine. boring.

▲ hosh 12 hours ago | parent | prev [-]

That sounds like a neat idea. Do you have a proposal for that?

Would it be compatible with specifying urls (such as git repos)?

▲ hiharryhere 11 hours ago | parent [-]

Bundler already does this.

  # From a specific branch
  gem 'my_gem', git: 'https://github.com/user/my_gem.git', branch: 'development'

  # From a specific tag
  gem 'my_gem', git: 'https://github.com/user/my_gem.git', tag: 'v1.2.3'

  # From a specific commit (ref)
  gem 'my_gem', git: 'https://github.com/user/my_gem.git', ref: 'a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0'

	▲	hosh 8 hours ago \| parent [-]
		Yes, I know bundler does that. But I thought we were talking about urn instead of uri. Seems I was mistaken.