P2P support for sharing packages like torrent files #5289
Replies: 3 comments
-
|
I share your concerns. It is indeed a risk that we all live with and it's not insignificant. Having a p2p backup sounds good. Technically possible. But I see huge challenges looking at it from a consumer pov:
All package.json and tarballs are accessible in the filesystem (as a default) and can be shared via p2p. What's really missing in Verdaccio? |
Beta Was this translation helpful? Give feedback.
-
Hello @mbtools! I thank you so much for your response, mainly being a collaborator, that is good to hear constructive questions. I reach out to verdaccio because it is the nextiest thing that I can think about to allow one to host their own npm servers and reduce the impacts of a global npm outage. Answering your questions, I thought something like:
I'm sorry if I didn't correctly cover any of the topics, giving my vision here, I accept (and encourage) counterarguments to it, but it is my plan to try to achieve something like it, even if done as hobby and takes a little while, plugins are a good way to get kickstarted on that idea. |
Beta Was this translation helpful? Give feedback.
-
|
Sounds like a fun project. Let us know if you need enhancements in Verdaccio. Just an example of the scale we are talking about: the semver tarball is 27.7KB and downloaded 69.5million times per day = 183 GB. If your machine becomes a seeder (for packages), then you will pay for the data egress (others downloading from you). For a big host, that could become quite expensive. As you wrote, it all has to start from zero where scaling problems don't exist (yet 😉 ). |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
Hello my fellow companions! Today we've faced a very brief but concerning moment in the open source world: npm was offline and for a little while we were not able to install packages directly from npm. This affected everywhere: local development, deployments, tests and every kind of dynamic application that ever depended on installing npm packages. We should never be so centralized in a single one provider, but unfortnately - we are. Of course medium to big companies will have their own registries, but even them won't be able to store so many packages as npm itself - over two million.
What I am trying to say, and that was already said in this issue is that we need to have the ability and the freedom to install the packages when we want, without external dependencies, that's what open source means. With that objective I come here today to discuss again the idea of enabling users to use verdaccio with a p2p interface (basically, torrent) to obtain packages through the nearest seeder and distributed (could be even text files, supposing we had 5 million different packages, the final file size for containing hashes would be less than 500mb, we can also have different hash packing files to aggregate older versions of the libraries and use them as needed - this size is ok if we want to keep the package sharing secure)
I've even considered talking to universities to check if they are wanting to host "mirrors" of npm, but no one of them seems to care, so I had to come up with a solution that could work for everyone.
Beta Was this translation helpful? Give feedback.
All reactions