Vlt 1.0 and Hosted Package Registries

5 comments

• thataccount1 hour ago
  I am not sure exactly what this service is or why it is desirable. Pitch me in five seconds or less?
  • clarke781 hour ago
    5s: save time &amp; money<p>10s: vlt helps engineering teams build JavaScript software faster, reduce supply chain risk, and lower infrastructure costs (via. API perf &#x2F; payload optimizations).<p>20s: If you&#x27;ve used npm for years &amp; are just narrowly escaping the various malware attacks or are on the hook for running up CI&#x2F;agent bills at work because cold installs are X percent of the time compared to your actual builds&#x2F;runtime, then you should check us out.<p>22s: Also, &lt;insert jFrog grumble&gt;.
    • wesleytodd2 minutes ago
      To add a bit of non-Vlt (I work on the JS Platform Team at Netflix where I have driven many of our decisions in the package manager space the past 6 years) but highly involved and supportive community member:<p>The team that was able to ship the most important features for npm to be competitive in the modern JS stack from ~2020 was able to take a fresh look at the problem without the organizational baggage of Github&#x2F;Microsoft.<p>On the technical side, the ecosystem is maturing and we need a better set of foundational tools to meet that maturity level. This includes deep commitment to performance, security, and DX. The full product is more than just a package manager, it is a registry, a registry client, a task runner, and much more. Vlt is aiming to be this mature foundation.<p>Feel free to correct me if I am wrong on anything here Darcy.<p>P.S. grumble grumble...jFrog is a trash fire....grumble grumble
• viviansolide1 hour ago
  This will benefit the entire ecosystem. Well done.
• joeyagreco50 minutes ago
  So this is advertising as a secure npm?
• nerdalytics2 hours ago
  Over a year I joined the waitlist and almost forgot that I did. Today the registry is open to deliver on its promises—secure the supply chain.
  • clarke782 hours ago
    Founder here - thanks for the vote of confidence! We&#x27;ve got a lot more in store.
• merb2 hours ago
  Without identity federation via oidc it’s basically not really a replacement for verdaccio
  • clarke781 hour ago
    This is coming imminently but appreciate the feedback &amp; will push to get this landed here quickly. That said, our client does support OIDC publishing if your registry does so hopefully you&#x27;ll still find value there as it&#x27;s a major step up from legacy npm clients.