3 ms·
most of the code we run every day is very old. the idea with open source packages is that you do not have to repeat the work made by others. but you can improve
by z3t4 9y ago
most of the code we run every day is very old. the idea with open source packages is that you do not have to repeat the work made by others. but you can improve it if you can/want.
old code is often "battle tested" and thus it can actually be safer then something that get constant updates.
- yjftsjthsd-h 9y agoOld can be good, and unmaintained isn't always fatal, but many npm packages are network-facing, where security vulnerabilities need to be addressed.
- shp0ngle 9y agoThis is about packages that are just inactive forks of more popular packages Sure, you might want to install them, but probably you don't
- btbuildem 9y agoI don't think that holds in the JS world, practically or philosophically speaking.
- cyphar 9y agoThat's not related to the issue at hand, which is that users searching for actively maintained projects are getting sent to old unmaintained projects that are abandoned for reasons other than "it is so stable it needs no updates". It's like trying to install CUPS (last updated a month ago) but being redirected to cup-stacker-pro (last updated in 1997). Sure, it's definitely old code, but is it really a good idea to install it? But I also disagree that old code is "battle tested". Old codebases and old projects are a different story. Running a binary built 10 years ago isn't generally a good idea, but running a modern release of a 10-year-old project is almost always better than a project started 2 weeks ago. The benefit of old codebases is the experience of the maintainers involved, but you don't get that benefit if the codebase hasn't been maintained (or you're using a release that was made before they gained that experience).