NPM CEO Bryan Bogensberger Resigned

No C-level exec resigns "effective immediately" without either a transition plan in place or something concrete lined up. I get wanting to allow him to say he resigned instead of he was fired, but the silly language of the press release just makes it worse.

Ididntdothis3• 7 years ago

Maybe “he wants to spend more time with family”?

dopamean• 7 years ago

This is my favorite excuse in sports because they "retiree" almost always comes back out of retirement which leads me to believe they've had enough time with their family.

mieseratte• 7 years ago

Only to get tired of them two weeks later and suddenly find himself with another CEO spot?

duxup• 7 years ago

Maybe it is true.

"Man I hate this place because ____, and I'd rather spend time with my family."

That doesn't preclude wanting to do other things too.

tomnipotent3• 7 years ago

I wish companies

Because it's not a soap opera and you're not owed anything about the personal business of other people. As an individual, I have every right to control the narrative for why I've left a company (assuming nothing illegal).

hn_throwaway_992• 7 years ago

That's my whole point. I fully understand not wanting to air everyone's laundry. I'm just suggesting that nobody is buying their silly lies, so if they think they are "controlling the narrative" they are sorely mistaken.

pluma4• 7 years ago

Sure but at a certain point it just harms your credibility if instead of owning up to the incredibly bad mistakes you still pretend you're only leaving because the grass is greener elsewhere.

I know it's standard business procedure to outright lie about these things but it becomes farcical when you basically sink an entire company and then get to "resign" and pretend it's not because you did a terrible job.

paulddraper6• 7 years ago

What difference would that make?

privateSFacct• 7 years ago

Story is all about his “success” and desire to seek new opportunities- why not a few sentences about the ongoing labor related litigation.

ASalazarMX• 7 years ago

It's a press release, not a news article. It only says what NPM Inc. wanted to say, in the way they desired.

dstaley• 7 years ago

I actually think that litigation is no longer ongoing; Kate Conger from the NY Times is reporting that the case was settled. [1]

Edit: linked article says the case was settled in June. [2]

[1] https://twitter.com/kateconger/status/1175097388253376512

[2] https://www.nytimes.com/2019/07/08/technology/tech-companies...

fharper14• 7 years ago

You are right, a settlement has been made.

Touche• 7 years ago

"resigned"

asien• 7 years ago

I’m fascinated by the fact that while node has become a new standard in the industry , and the project is receiving lots of supports from all sorts of companies ( IBM , Microsoft etc...) absolutely no discussion has been opened about how much at risk the JavaScript ecosystem actually is with « npm » and it’s weekly dramas

Not a month pass without something going wrong inside of inc, millions of developers are dependant on it but nothing seem to worry people...

TimothyBJacobs• 7 years ago

There has been. CJ Silverio gave a talk on that topic at JSConf this year: https://www.youtube.com/watch?v=MO8hZlgK5zc

See also Entropic as a possible alternative to NPM: https://github.com/entropic-dev/entropic

pluma4• 7 years ago

For context: Entropic was started by several former npm Inc core developers including CJ who left the company after the CEO change was announced internally. CJ herself is the former CTO of npm Inc.

Basically most of the top developers have left the company, others were laid off. It seems to be only a matter of time until none of the people working on npm a year ago remain.

tuananh• 7 years ago

i doubt entropic will become sth significant. it already lost the momentum it seems.

humtum• 7 years ago

People care. Developers have limited registry options due to lock-in. Creating effective security processes across a massive ecosystem of open source developers is a difficult problem. Registries can't easily create security practices that fit into a heterogenous pool of oss governance and development models. Especially when implementing more rigorous security has the potential to diminish their network effects and developer productivity. Curious to see how npm, GitHub Package Manager, and others address these issues.

paulddraper6• 7 years ago

The people that would care the most are mostly immune to npm issues.

Privately hosted npm repos, checked-in to version control systems, etc.

There are plenty of solutions if you don't like npm. However, they carry the traditional costs of managing dependencies; if you want super super super easy above all else, that's what npm does.

tiborsaas• 7 years ago

I don't think that's accurate. Most devs and thus companies treat NPM as a utility. Maybe very large companies would not feel it, but if NPM went down tomorrow there would be utter chaos on the internet.

knightofmars• 7 years ago

Yes. The Node ecosystem is a huge liability just waiting to happen. Any organization that depends on NPM is making a huge gamble. You can do a lot to mitigate this (private NPM repo, locks) but the reality is that the dependency chains are dangerous. Is someone in an organization going to audit all of those dependencies? Especially under the circumstances where they've been declared without an explicit version (>, >=, <, <=, ~, ^, 1.2.x, *).

president• 7 years ago

As someone who has no insight into the Node/NPM/JS world, how is this different from Python's PyPi, which I would think suffers the same issue?

cjblomqvist• 7 years ago

Honest question, is it that much better in other communities? In particular, it's there anything inherent to npm that's problematic or is it just that a huge community with a Unix mindset (small packages that does one thing well) is problematic?

jonny_eh2• 7 years ago

Any community dependent on a particular repo is at risk. I'd argue that RubyGems is just as risky as NPM, for example.

The problem is that there's no good fix or alternative, it's hard to avoid a single point of failure.

pluma4• 7 years ago

No other package manager is run by a VC backed startup. That's inherently problematic and means the registry is in the hands of a company that could be killed off or sold at any moment because it needs to make massive profits (without having any way to truly make a profit in the first place) to continue to exist.

torben-friis• 7 years ago

Lack of a large enough standard library is a big differenciating factor, as it makes you very dependent on third party libraries.

Even if you avoid it by creating your own utils, chances are that the creators of the large packages you use (like a database manager or a rest framework) will depend directly or indirectly of those third party tools.

qbaqbaqba• 7 years ago

It was a problem in otherwise very successful perl's CPAN. I don't recall any "dramas", but because of a huge number of dependencies installing Catalyst had a low change of going right the first time. But! Because of the test everything culture and CPAN testers effort broken modules were very rare. So after you managed to set up your system and had a long walk while tests would run it was guaranteed to work. More or less.

r3trohack3r• 7 years ago

There is actually a lot of discussion about this. There is also a lot of work going into different approaches to solve this.

For example Frea. It's a conservative approach for incrementally federating the package registry and you can start using it today. It's ready for all your traffic.

website: https://freajs.com

how it works: https://docs.google.com/presentation/d/16pxrYfpxxKRzhpMM0zZV...

paulddraper6• 7 years ago

Why was this downvoted?

cols2• 7 years ago

Looks as if he was asked to leave. No surprise given the terrible optics they've been under for the past year. NPM is such a vital tool and I really enjoy using it. I hope their next CEO makes better decisions in regards to the humans who work there. Good luck to all the NPM staff! I'm rooting for you!

From the Register...

"According to people familiar with the matter, Bogensberger was asked to leave by the company's board of directors." [0]

For more context...from Jonathan Cowperthwait, NPM's former vice president of marketing...

"Many of us spent the last year watching our friends and colleagues' struggle through our fingers, but I'm still profoundly confident in the company's ability to turn this around. Sometimes bad executives happen to a good company." [1]

[0] https://www.theregister.co.uk/2019/09/20/npm_ceo_bryan_bogen...

[1] https://www.businessinsider.com/npm-ceo-bryan-bogensberger-r...

sneak2• 7 years ago

Why was he asked to leave? To which “terrible optics” do you refer? Your implied context is opaque.

cols2• 7 years ago

If the context is opaque to you then I would encourage you to read the articles and to read the other comments on this thread.

fharper14• 7 years ago

Here is some background on some of the things that happened while he was CEO: https://twitter.com/fharper/status/1111694552262459393

dredmorbius2• 7 years ago

Elsewhere in thread:

https://news.ycombinator.com/item?id=21029344

Sephr• 7 years ago

Under Bryan's leadership, multiple namespaces (left-pad, etc.) including my own (file-saver) have been wrongly transferred to new owners without authorization from the previous owners.

npm can't handle security, and they have been sorely in need of new leadership for years.

ulkesh• 7 years ago

If only there were other dependency management build tools they could use as good examples to emulate....

NPM CEO Bryan Bogensberger Resigned

Related Stories