5 ms·

"When a customer signs up with Tidelift, the company analyzes the customer's code to see what open source software it depends on, and what open source projects

"When a customer signs up with Tidelift, the company analyzes the customer's code to see what open source software it depends on, and what open source projects those programs depend on. Tidelift then charges a subscription fee based on the number of participating projects a customer relies on." Sure, just run `npm install` and try to come up with a reasonable number that will look like something i'll be willing to pay for.

mpolichette 8y ago
Yeah cause our companies love to let third parties “analyze” our code.
- hp 8y ago
  It's analogous to something like Code Climate, Coveralls, TravisCI, etc. Some companies require an on-premise version or want to run the scan themselves and only call an "upload my dependencies as JSON" API, which is fine. The scan is only to get the list of deps and their versions, it doesn't care about the actual source code.
- DannyB2 8y ago
  For a Java program, just gather the "import" declarations from every single source file. Consolidate those into a single file, removing duplicates, sort them. You now have a list of everything used by your program. Remove all of the internal imports. That is imports from other parts of your own software. (Hint: this is easy since they are sorted by package name.) Now you have a list of all third party software used. I suspect this same procedure works for C / C++ / Python and probably other languages. You don't have to give anyone your source code to discover what third party and open source software you are using.
cheeze 8y ago
The sheer amount of open source code that pretty much any software out there runs on is absolutely astonishing. Especially when you start taking into account transitive dependencies. Say I'm running Java... Someone had to compile the JVM and it was probably done on an open source compiler. Crazy to think of how many thousands of man hours have gone into something as simple as allowing me to argue with someone over the internet.
kbenson 8y ago
You mean providing leftpad to the world isn't worth a buck a month from thousands of different people? I mean, that might have taken someone a while five minutes to write. If they weren't that familiar with JavaScript and had to look up some stuff in the docs that is...
rzzzt 8y ago
Will eg. left-pad receive the same amount as Express?
- hp 8y ago
  No. https://tidelift.com/docs/lifting/paying https://tidelift.com/docs/lifting/paying has the long answer to that.
hp 8y ago
Hi, Tidelift cofounder here. This is a reason we don't charge per-package. It costs the same whatever customers report. (Which is what the Wired "Netflix" analogy is about.) The incentive to report accurately is that subscription benefits only apply to packages we know someone's using. Some of those benefits are dependency analysis results, others are services or assurances. For example, we'd only know to tell them about security vulnerabilities in a package they actually say they use.

mpolichette 8y ago

Yeah cause our companies love to let third parties “analyze” our code.

hp 8y ago
It's analogous to something like Code Climate, Coveralls, TravisCI, etc. Some companies require an on-premise version or want to run the scan themselves and only call an "upload my dependencies as JSON" API, which is fine. The scan is only to get the list of deps and their versions, it doesn't care about the actual source code.
DannyB2 8y ago
For a Java program, just gather the "import" declarations from every single source file. Consolidate those into a single file, removing duplicates, sort them. You now have a list of everything used by your program. Remove all of the internal imports. That is imports from other parts of your own software. (Hint: this is easy since they are sorted by package name.) Now you have a list of all third party software used. I suspect this same procedure works for C / C++ / Python and probably other languages. You don't have to give anyone your source code to discover what third party and open source software you are using.

cheeze 8y ago

The sheer amount of open source code that pretty much any software out there runs on is absolutely astonishing. Especially when you start taking into account transitive dependencies. Say I'm running Java... Someone had to compile the JVM and it was probably done on an open source compiler. Crazy to think of how many thousands of man hours have gone into something as simple as allowing me to argue with someone over the internet.

kbenson 8y ago

You mean providing leftpad to the world isn't worth a buck a month from thousands of different people? I mean, that might have taken someone a while five minutes to write. If they weren't that familiar with JavaScript and had to look up some stuff in the docs that is...

rzzzt 8y ago

Will eg. left-pad receive the same amount as Express?

hp 8y ago
No. https://tidelift.com/docs/lifting/paying https://tidelift.com/docs/lifting/paying has the long answer to that.

hp 8y ago

Hi, Tidelift cofounder here. This is a reason we don't charge per-package. It costs the same whatever customers report. (Which is what the Wired "Netflix" analogy is about.) The incentive to report accurately is that subscription benefits only apply to packages we know someone's using. Some of those benefits are dependency analysis results, others are services or assurances. For example, we'd only know to tell them about security vulnerabilities in a package they actually say they use.