I don't think the OSS work around GNU, etc, can be directly compared to the "new" model around npm/gems/pip/etc, which has really only been going for a bit over 10 years. I can't put my finger on why they're different, but they definitely feel different.

The big question is what happens when a maintainer wants to retire and a successor can't be found? Or (as in this case), when a maintainer gets so annoyed by their users that they refuse to continue co-operating with their user base.

We don't really have an answer for either of these questions yet, and we won't bump into them until maintainers get old or angry. But we have been predicting that this problem will happen.

Now we're bumping into this problem, it's our new reality. What's the solution?

The package ecosystem is growing and there’s more good packages each year. 10 years isn’t 30, but it’s still a long time to show success.

That’s there’s only been a few problems like this despite millions of users is a sign of strength.

I hedge by pinning yo specific versions and keeping my own package manager (RStudio) to keep mirrors if the packages I scan. That the packages are open source means they are easier to scan or fork.

If a maintainer stops then the project can be forked. If nobody wants to fork then that probably means no one cares enough. And that’s ok.

Mostly it forces us to be flexible. I don’t think software is a thing but a process or cycle.

Success != sustainability.

If a thing has an expiry date that is >10 years, then you're not going to see any problems for 10 years. That doesn't mean the expiry date doesn't exist, or that the thing won't hit it. It can be wildly successful for all those years and then hit the expiry date and stop immediately.

It’s not necessarily the same, but it’s a good co-signal. And definitely useful for refuting emotional, data less calls that the sky is falling.

I’ll take a decade of success as a sign of sustainability over a package maintainer losing their shit as a sign of h sustainability.