{"action":"created","issue":{"url":"https://api.github.com/repos/npm/npm/issues/12045","repository_url":"https://api.github.com/repos/npm/npm","labels_url":"https://api.github.com/repos/npm/npm/issues/12045/labels{/name}","comments_url":"https://api.github.com/repos/npm/npm/issues/12045/comments","events_url":"https://api.github.com/repos/npm/npm/issues/12045/events","html_url":"https://github.com/npm/npm/issues/12045","id":143219675,"number":12045,"title":"Should I trust npm?","user":{"login":"jamesjnadeau","id":2386054,"avatar_url":"https://avatars.githubusercontent.com/u/2386054?v=3","gravatar_id":"","url":"https://api.github.com/users/jamesjnadeau","html_url":"https://github.com/jamesjnadeau","followers_url":"https://api.github.com/users/jamesjnadeau/followers","following_url":"https://api.github.com/users/jamesjnadeau/following{/other_user}","gists_url":"https://api.github.com/users/jamesjnadeau/gists{/gist_id}","starred_url":"https://api.github.com/users/jamesjnadeau/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jamesjnadeau/subscriptions","organizations_url":"https://api.github.com/users/jamesjnadeau/orgs","repos_url":"https://api.github.com/users/jamesjnadeau/repos","events_url":"https://api.github.com/users/jamesjnadeau/events{/privacy}","received_events_url":"https://api.github.com/users/jamesjnadeau/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/npm/npm/labels/needs-discussion","name":"needs-discussion","color":"0A98AC"},{"url":"https://api.github.com/repos/npm/npm/labels/support","name":"support","color":"000000"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":12,"created_at":"2016-03-24T11:15:21Z","updated_at":"2016-03-24T22:39:41Z","closed_at":"2016-03-24T22:02:56Z","body":"In #12017 \r\n@othiym23, you said the following, and I'm deeply troubled by it.\r\n> So because I want to have an evening away from this, I'm going to ... lock this issue.\r\nhttps://github.com/npm/npm/pull/12017#issuecomment-200145661\r\n\r\nI've waited 24 hours now since I saw this, but the ban has yet to be lifted. This statement and action is eye opening for me and I hope for the rest of the community.\r\n\r\nI have valid concerns, and opinions that I would like to share, and I’d like to  think I have something to add to the conversation that has not been said. \r\n\r\nI can empathize with your concerns and desire for a quiet evening. I hope you had one. That's your choice to make, and I hope you have evenings such as you desire for the rest of your days. That’s your right and choice.\r\n\r\nHowever, your choice to ignore, redirect, or turn off notifications you receive should not dictate how and when I can contribute to the conversation. I can understand stopping a conversation for other reasons, but because you personally don't want to hear it at that moment in time is not a valid reason I think this community should accept.\r\n\r\nYour action of taking away my ability to add to that conversation hurts me as a contributing member of the community, and the community as a whole. ( you can say I’m speaking here, but you are missing my point )\r\n\r\nYour statement and action, from my perspective, come from a selfish reason, and not with the communities best interest in mind.\r\n\r\nWhen you don't allow community members to contribute, you break the trust that is established between you as the open source administrator, and us as a community who wishes to use your software and give back in any way we can. \r\n\r\nTrust is a fickle thing though. \r\n\r\nTrust is built upon commitments and following them through with actions. When you publish a package to npm, you are making a commitment that this package is available for the world to use. \r\n\r\nYou've taken an action to share your code with the world, and I should trust and expect that package to be available in npm, and npm will make it available to me in the future if I need it. Perhaps my expectation is wrong, but I share it with many others.\r\n\r\nIf you, as a package maintainer, take that package down, I lose trust in you, but also in npm as a place I can depend upon to get me the software I need. That’s what a package manager is for, right?\r\n\r\nA couple years ago, when shrinkwrap first came out, and was preached as a way to avoid the need to check your npm dependencies into version control, the community was told that's the 'preferred method'.(https://www.npmjs.org/doc/misc/npm-faq.html#should-i-check-my-node_modules-folder-into-git, the docs have been updated, since, but a trip to the wayback machine will show you what I'm talking about.) We trusted you, as the project’s creators, to tell us the best way to use it. \r\n\r\nNow, over the past 2 years, we've had several incidents that make me call into question the above commitments and trust that has been established. I can no longer trust that npm will have the package I need in the future. I now need to take actions to deal with that reality.\r\n\r\nWithout this trust and expectation of what the future holds, the use cases for npm as a package manager are extremely limited. This hurts the software, and more importantly the business that npm uses to sustain itself from my understanding. \r\n\r\nWhat this long winded explanation is getting at, is that there has been a series of decisions, commitments, and actions that this project’s maintainers have taken that have eroded the trust of it's users.\r\n\r\nI can't trust that a package will always be available.\r\nI can't trust npm will keep a published package around.\r\nI can’t trust they will respect my actions of unpublishing something from npm.\r\nI can’t trust that project maintainers will at least listen to my concerns.\r\nI can’t trust…..\r\n\r\nI imagine the number of people taking a look at how much they trust, need, and depend on npm right now is huge. I’m actively taking steps to mitigate how much I depend on this project to be available, and at what point in my development process I make use of it. I’ve talked to others doing the same.\r\n\r\nI’m taking actions that demonstrate my loss of trust with this project. In doing so, I can see multiple ways in which the npm organization is much less involved with the work I produce. This series of thoughts doesn't make me want to open up my wallet for you anytime soon. Quite the opposite.\r\n\r\nIs this what you want your community members to be thinking and doing right now?\r\n\r\nHere's what I originally wanted to ask in #12017 :\r\nIs there any data available that we can cite to see how many packages have been unpublished. A list of reasons that most users unpublish a package would be extremely helpful for this conversation. I'd be interested to hear who wants to keep unpublish around other than the project maintainers? I haven't heard that opinion voiced, I'd love to hear more about that side."},"comment":{"url":"https://api.github.com/repos/npm/npm/issues/comments/201059062","html_url":"https://github.com/npm/npm/issues/12045#issuecomment-201059062","issue_url":"https://api.github.com/repos/npm/npm/issues/12045","id":201059062,"user":{"login":"caseyhoward","id":16295,"avatar_url":"https://avatars.githubusercontent.com/u/16295?v=3","gravatar_id":"","url":"https://api.github.com/users/caseyhoward","html_url":"https://github.com/caseyhoward","followers_url":"https://api.github.com/users/caseyhoward/followers","following_url":"https://api.github.com/users/caseyhoward/following{/other_user}","gists_url":"https://api.github.com/users/caseyhoward/gists{/gist_id}","starred_url":"https://api.github.com/users/caseyhoward/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/caseyhoward/subscriptions","organizations_url":"https://api.github.com/users/caseyhoward/orgs","repos_url":"https://api.github.com/users/caseyhoward/repos","events_url":"https://api.github.com/users/caseyhoward/events{/privacy}","received_events_url":"https://api.github.com/users/caseyhoward/received_events","type":"User","site_admin":false},"created_at":"2016-03-24T22:39:41Z","updated_at":"2016-03-24T22:39:41Z","body":"I agree with @dolkensp. Un-publishing a package should hide it. Shrinkwrapping is completely pointless if you allow things to be deleted from the registry. If I shrinkwrap something that means it's already downloaded in my node_modules directory. If I wipe out my node_modules directory and run npm install I expect my modules to be downloaded exactly as described in my npm-shrinkwrap.json file. If that isn't the case I must check in all of my node_modules to source control thus making shrinkwrapping totally worthless. You either need to get rid of the ability to delete packages or get rid of the \"npm shrinkwrap\" command since it's broken and dangerous.\r\n\r\nAlso, if I wanted to go the route of not checking my node_modules into source control and then realize that a package was deleted but it's still in my node_modules directory, then I'm just going to republish it. Unpublish didn't solve anything. It just created extra work for me."}}