jbaruch_s

It is exactly as convenient (if not more). You set up a set of 3 repositories (local for your modules, remove to proxy the PyPI, and virtual, which unifies them under a single URL (which solves the #2 you mentioned).

So, both points are incorrect.

Ouch, that's bad, shouldn't happen and usually doesn't happen. Ping me in DMs on Twitter (@jbaruch) or by email (jbaruch@jfrog.com) and I'll investigate what happened.

Re Bintray isn't standard: There is no standard, both Bintray and Maven Central are just internet repositories. JCenter is bigger, so if you define "standard" as "bigger one", Bintray is the way to do.

If by "standard" you meant "default", like Maven Central is the default in Maven, here I have some news for you as well. Bintray is the default in Mac OS' Homebrew, Android Studio, Groovy's @Grab, and first class citizen in Gradle, Ivy and SBT.

They'd better not. Nexus has horrible node.js support: https://www.youtube.com/watch?v=0yctqs1sN8U

Check Artifactory instead, they have first class support

(Disclaimer: I am with JFrog).

Brian, how ignorant of you (again). The docs on signing are public, you could read before spreading FUD.

That's very true. That's why Bintray has both "web identity verification" and pgp signing, while Maven Central gives you signing only, without a way to really identify the author.

Look at twitter. Everybody can't be happier because Maven Central is served over SSL now. That's good. But if you can't verify what they serve you over SSL it worth nothing. I glad you understand that. Most of the people seem not to. Once you understand that, how can you verify the content? Bintray helps with that, Maven Central makes it hard.

They do blame the reason they didn't do it on the lack of demand from the users.

Well, in that case @iancarroll didn't read the post. What he claims I don't understand is exactly what the post says.

The author of what?

Is it enough? http://blog.bintray.com/2014/08/04/feel-secure-with-ssl-thin...

I am not sure how the fact that Bintray is DDOSed from China (and still fully operational without any interruption) dismisses your trust in Bintray.

I am also not sure how you figured out those are fake downloads. For sure the script that DDOSes Bintray from China won't use Groovy, but it's a still a valid download. Not for showcasing how popular Groovy is (they factor out those things when talking about the numbers), but for the raw statistics - for sure. The file was downloaded, wasn't it?

Please elaborate?

Full disclosure - I am a developer Advocate with JFrog, the company behind Bintray.

So,jcenter is a Java repository in Bintray (https://bintray.com/bintray/jcenter), which is the largest repo in the world for Java and Android OSS libraries, packages and components. All the content is served over a CDN, with a secure https connection. JCenter is the default repository in Goovy Grape (http://groovy.codehaus.org/Grape), built-in in Gradle (the jcenter() repository) and very easy to configure in every other build tool (maybe except Maven) and will become even easer very soon.

Bintray has a different approach to package identification than the legacy Maven Central. We don't rely on self-issued key-pairs (which can be generated to represent anyone, actually and never verified in Maven Central). Instead, similar to GitHub, Bintray gives a strong personal identity to any contributed library.

If you really need to get your package to Maven Central (for supporting legacy tools) you can do it from Bintray as well, in a click of a button or even automatically.

Hope that helps!