DEV Community

Discussion on: How do we improve security in the npm ecosystem?

 
herrfugbaum profile image
Pascal

Yeah this could lead to a better maintained kind-of stdlib for js.
But it might also lead to an even more fragmented ecosystem, where it is most lucrative to publish a lot of one-liners and hope that a big project will use it somewhere in it's dependency graph.

It would also leave other kinds of packages more or less unpaid. Take for example a cli app. No one will depend on it, while it could have millions of downloads at the same time. On the other hand, that's a different kind of problem as it wouldn't have such an impact on the generell ecosystem and could be targeted by donations, one time payments or something like that.

Thread Thread
 
xowap profile image
Rémy 🤖

The revenue split is certainly a tricky question, however at this point it seems obvious that:

  1. Open-source maintainers
  2. The only thing that seriously dented piracy is Netflix/Spotify/Steam

When it's easier to buy it people tend to do so. I definitely think it's worth working around that idea.

Thread Thread
 
aghost7 profile image
Jonathan Boudreau

The problem I see is we're not dealing with people, we're dealing with organizations. Its a bit odd but I don't think a company would decide to pay for such a service.