I'm starting to wonder if this is just a fundamental weakness of open source software. Compare with a commercial platform, such as .NET or Cocoa - there you've

I'm starting to wonder if this is just a fundamental weakness of open source software. Compare with a commercial platform, such as .NET or Cocoa - there you've got more "batteries included" libraries, with relatively large, standardized packages that have short dependency trees, being maintained by people who are paid to pay attention to these sorts of details. This isn't to say that commercial software is bug-free - far from it. If something passes code review, it's not going to be looked at again until someone's being paid to look at it again. Which gets you to a similar place as with open source: Software is buggy. Mostly, though, it leaves me thinking that the whole ideal of, "It's open source, so you can assume many eyes are looking at it," is a pipe dream. Probably the bystander effect is closer to the truth: If it's a small project, I'm relatively likely to at least cursorily look over the code before taking a dependency on it. If it's a big project, though, I just assume someone else is doing that. Just like everyone else. If it's a big project taking dependencies on small projects, though, that seems to be the worst situation. Nobody can make sense of that.