3 ms·

> open source projects can disappear without notice 1. They can't. Someone can decide to stop working on a project, but it can not disappear. 2. You know wha

• op00to 10y ago
  > 2. You know what can disappear? commercial products. This this this this! In fact, commercial software is GUARANTEED to disappear. Once it is no longer profitable to support the software, the commercial outfit has a duty to stockholders (in the case of public companies) to abandon the software and their customers. Once it's abandoned, it's impossible to provide support. At least with open source projects, you have both pieces of the broken case to glue back together when it brakes. If you are a Red Hat customer, I bet they would be game to talk to your auditor about the merits and benefits of open source security.
• tedmiston 10y ago
  Re 2: Perhaps the auditor isn't referring to open source products being shutdown, but rather package info being pulled abruptly making the package inaccessible for some period of time. Particularly I'm thinking of the whole npm left-pad fiasco (http://blog.npmjs.org/post/141577284765/kik-left-pad-and-npm http://blog.npmjs.org/post/141577284765/kik-left-pad-and-npm, https://medium.com/@azerbike/i-ve-just-liberated-my-modules-9045c06be67c https://medium.com/@azerbike/i-ve-just-liberated-my-modules-...).
  • op00to 10y ago
    A responsible enterprise shouldn't be basing production deployments on package repositories that can get yanked. Mirror that shit if you want to keep making money.