josevalim

josevalim

Creator of Elixir

It depends on what you mean by multiple sources.

As far as I know, Hex already provides mirrors via fast.ly and allows you to set your own mirrors and even change the HEX_API endpoint.

If you mean literally multiple sources, with packages coming from different places, then that’s exactly what the private organizations feature provide. When you specify {:foo, organization: "foobar"} that’s a shortcut for {:foo, repo: "hexpm:foobar"} and that repository can be anything, including something that you host on your own and is not part of Hex.

2
Post #12
ryanwinchester

ryanwinchester

If I wanted to sell access to a private package, would I be able to generate access tokens or something programmatically?

0
Post #13
OvermindDL1

OvermindDL1

/me has finally determined why this whole private package and organization thing causes fear in self…

1
Post #14
josevalim

josevalim

Creator of Elixir

This is unwelcoming and unfair for both the work being put on Hex and to @ryanwinchester which is completely within his rights to sell software.

5
Post #15
OvermindDL1

OvermindDL1

I’m of the general opinion that Work should be paid for, not Products. Patreon is a good example of this. Like I could see Hex being a service that allows people to donate to certain/multiple authors if the authors accept donations either once or on-going, these tend to work quite well in my prior experience, but when software starts get locked behind walls I’ve seen and experienced communities that stop growing at best and die at worst thereafter. Every-single-time I’ve experienced an open source community starting to lock software behind money then that is eventually what it all becomes about as those that go for money instead of advancement start pushing (in some personal experiences very forcefully) the open source authors out and as I’ve experienced that multiple times in the past (in two cases very very personally) it is scaring the hell out of me…

EDIT: Don’t get me wrong, organizations are a great idea (we can have identically named packages in different organizations would be an awesome feature!), and packages should have a private status (great for locking out old/broken packages and handling ‘in-dev’ packages that are not suitable for public consumption), but it is a great basis to lock out the ecosystem if not careful, and I know that not only can it be done but I’ve seen it done multiple times in the past…

0
Post #16
dimitarvp

dimitarvp

@OvermindDL1 The dangers you outline highly depend on how will Hex creators handle it mid- and long-term. Private packages are only useful for organizational development teams since it’s very costly in terms of both money and development hours to roll your own package repository. Nothing wrong in outsourcing that expense to Hex itself.

Additionally, many organizations would much prefer to refactor out useful / value-adding components as public and OSS packages, so not even all companies would use the private packages functionality.

The main motivation I see behind paid private packages are mostly because of the potential very long-term investment a company might make in Elixir; I needn’t remind anybody around here that there are still banks that hire COBOL consultants for $400 an hour to fix 25+ year old systems. In the same lane of thought, organizations might have 50+ private packages measuring tens or hundreds of megabytes big and they might use them for 20+ years as well.

Hosting costs money, we all know it. When it’s for the public good, many people choose to benefit the society for free and I commend them for that. However, when you have a big company like the above theoretical one, their servers might pull private packages tens or hundreds of times a day for their CI process. That would be a lot of load. If the load keeps growing without Hex having the budget to cover hosting expenses, then Hex won’t last long.

Lastly, companies like the idea of paying for a service and being rid of the responsibility to maintain the thing, plus it gives them the peace of mind that the service won’t just shut down next year.

That being said, CI processes pulling public/free packages from Hex thousands of times daily is also a reality and I don’t know how the maintainers handle it. Maybe making a federated network of copies of Hex is a good idea for the future; all mirrors except the main node will only ask for differences through IDs / checksums and will periodically suck the updated packages (or simply employ a normal CDN). That might help Hex’s free version remain free forever. But that’s long-term.

(Edits #1 and #2: typos or grammar.)

2
Post #17
OvermindDL1

OvermindDL1

Oh no not at all, I did not get my thoughts over right! I’m all for hex offering extra options like that (heck, I could host hex’s hosting in full with little hit on my servers), what scares me is the average library starting to be behind a paywall, this is not a hex thing, this is a community and the people in it thing. Like I said I’m all for organizations and private repo’s sure, what I’m not for is for putting public (non-internal-corporation-etc…) libraries behind paywalls as a growing ‘standard’. The question by the other person above of basically asking how to put a paywall up in front of their library on the public package system (a token/license to access it) is a death-knell in multiple places I’ve been…

0
Post #18
dimitarvp

dimitarvp

Don’t quote me on this, but historically the open-source community has been quite good in isolating the software authors who ask money from you if you sneeze.

The Elixir community is stable and the people who join it are believing converts (me included). There’s no way Hex isolates that community. Furthermore, I am convinced there are people in this forum who’d donate hard cash to Hex if it has trouble with its hosting expenses – and I am one of them.

As Jose said, it’s fully within the right of someone to sell their software – I’d go a different way, like pre-packaging my app and signing it with the keys of the customer, but let’s not go off-topic.

0
Post #20
OvermindDL1

OvermindDL1

I’d donate hosting to them in a heartbeat (my actual money is… low… very low…). ^.^

And I have no issue with someone selling their software in the usual areas where things are sold (their website, amazon, etc…), but not selling them via an open package repository. The only times I’ve seen that start to be allowed did not end well (in one case I was close in the entire ecosystem locked up, there is not an open source thing left, in the other case I was close in it became… loud, eventually the parent company who had no stakes in the open source parts had to very heavily handed shut down the ones trying to lock out what was happening behind paywalls, this one ended well but only because there was a very legal reason to not allow what they were doing).

1
Post #21
ericmj

ericmj OP

Elixir Core Team

The main purpose of Hex is still to provide a public and free repository of packages. Companies were asking for a way to host their private packages on Hex.pm and I saw this as way to pay for the costs in running the public repository.

I don’t see a reason for why we should forbid anyone to sell packages they host on Hex.pm, in fact I’m not even sure that would be legal. Remember that this is also possible to do with GitHub or any other service that lets you host code. I haven’t heard anything about the open-source community being negatively affected because GitHub has a service for hosting private code, so I don’t think the Hex ecosystem would be negatively affected either.

3
Post #22