3 ms·
If you can't evaluate the trustworthiness who you're handing the package over to, just don't hand it over. Mark it as deprecated and call it a day. This is Open
by xvector 8y ago
If you can't evaluate the trustworthiness who you're handing the package over to, just don't hand it over. Mark it as deprecated and call it a day. This is Open Source 101.
- Ayesh 8y agoGitHub has a Read Only option, and package managers of most languages have a way to convey that the project is abandoned or provided security fixes only. You don't have to feel guilty to abandon the projects. Most us do it, every day.