News for hackers. Stuff that matters.
Re:Dev corrupts NPM libs 'colors' and 'faker', breaking thou... by marcus_holmes on Monday January 10, 2022 @05:49AM (#29872906)
How many other maintainers are getting increasingly annoyed at the users of their code? Entitled users demanding changes to fit their use cases, megacorps using the code for free, other megacorps forking the code and launching it as a commercial service, we've been hearing for years about the problems of being an OSS maintainer.

Focusing on the troubles of this one person is a mistake. Of course the more "unbalanced" individuals will crack first. But we should expect more and more to go the same way (not necessarily by sabotaging their code though).

This model of software development is unsustainable.

Re:Dev corrupts NPM libs 'colors' and 'faker', breaking thou... by prepend on Monday January 10, 2022 @06:07AM (#29873055)
> This model of software development is unsustainable.

I don’t think this is right. It seems very sustainable as evidenced by 30+ years of sustained OSS development.

It seems very sustainable as we live in a time of the best OSS software ever produced with more high quality software than ever produced by ideological volunteers.

I’ve seen statements similar to yours and they just seem so at odds with reality.

Re:Dev corrupts NPM libs 'colors' and 'faker', breaking thou... by marcus_holmes on Monday January 10, 2022 @06:18AM (#29873128)
I don't think the OSS work around GNU, etc, can be directly compared to the "new" model around npm/gems/pip/etc, which has really only been going for a bit over 10 years. I can't put my finger on why they're different, but they definitely feel different.

The big question is what happens when a maintainer wants to retire and a successor can't be found? Or (as in this case), when a maintainer gets so annoyed by their users that they refuse to continue co-operating with their user base.

We don't really have an answer for either of these questions yet, and we won't bump into them until maintainers get old or angry. But we have been predicting that this problem will happen.

Now we're bumping into this problem, it's our new reality. What's the solution?

Re:Dev corrupts NPM libs 'colors' and 'faker', breaking thou... by prepend on Monday January 10, 2022 @08:33AM (#29874500)
The package ecosystem is growing and there’s more good packages each year. 10 years isn’t 30, but it’s still a long time to show success.

That’s there’s only been a few problems like this despite millions of users is a sign of strength.

I hedge by pinning yo specific versions and keeping my own package manager (RStudio) to keep mirrors if the packages I scan. That the packages are open source means they are easier to scan or fork.

If a maintainer stops then the project can be forked. If nobody wants to fork then that probably means no one cares enough. And that’s ok.

Mostly it forces us to be flexible. I don’t think software is a thing but a process or cycle.

Re:Dev corrupts NPM libs 'colors' and 'faker', breaking thou... by marcus_holmes on Monday January 10, 2022 @09:03AM (#29874927)
Success != sustainability.

If a thing has an expiry date that is >10 years, then you're not going to see any problems for 10 years. That doesn't mean the expiry date doesn't exist, or that the thing won't hit it. It can be wildly successful for all those years and then hit the expiry date and stop immediately.

Re:Dev corrupts NPM libs 'colors' and 'faker', breaking thou... by prepend on Tuesday January 11, 2022 @06:13PM (#29899794)
It’s not necessarily the same, but it’s a good co-signal. And definitely useful for refuting emotional, data less calls that the sky is falling.

I’ll take a decade of success as a sign of sustainability over a package maintainer losing their shit as a sign of h sustainability.

Re:Dev corrupts NPM libs 'colors' and 'faker', breaking thou... by herbst on Monday January 10, 2022 @07:32AM (#29873798)
Every single cent earned in my career depends on OS software in one way or another. Maintaining a public repo or two can very well be considered part of your job, or purely for giving back something.

I for one enjoy if anyone makes money with help of my code. I very well know I wouldn't have made it so far without many many others having chosen this way before.

Re:Dev corrupts NPM libs 'colors' and 'faker', breaking thou... by marcus_holmes on Monday January 10, 2022 @09:06AM (#29874962)
I agree, but the number of people I know who could maintain a popular OSS lib for years is tiny. I certainly couldn't do it, nor would I want to; I don't have the right kind of personality for that job.

I'm happy to contribute code, or documentation, but that's not the same thing.