7 ms·

I think this is the clearest, easiest, correct answer. If you no longer have the time and motivation to maintain a project, and are also not in a position to ha

I think this is the clearest, easiest, correct answer. If you no longer have the time and motivation to maintain a project, and are also not in a position to hand over control to someone you have good reason to trust, the easy, safe answer is to retire it, and have others fork. Then in the original project you can say “the last version of this project is N.N; here are some possible candidate successor forks, which have not been vetted”. This way no one who is merely keeping up with version numbers will accidentally step off of a reasonably good package on to a fraudulent package.

Novashi 8y ago
>I think this is the clearest, easiest, correct answer. If you no longer have the time and motivation to maintain a project, and are also not in a position to hand over control to someone you have good reason to trust, the easy, safe answer is to retire it, and have others fork. To prescribe some preventative advice based on this: it's probably not a good idea if your project gets popular to continue being a solo developer in open source. So plan ahead based on your popularity. And your project isn't likely to explode in popularity over-night and be a dependency for 1000+ other projects, so you should be able to see this coming. Of course, this is super-easy to prescribe in hindsight.
wpietri 8y ago
I 100% guarantee you that if he did that, he'd be getting a lot of static about how he should have handed the package over to some contributor.
- danso 8y ago
  Which other similar situations are you thinking of?
  - Rotten194 8y ago
    left-pad
    - mifreewil 8y ago
      left-pad was a very different situation. The maintainer unpublished the module from npm. I forget the reason, but I want to say it was some sort of rage quit.
      - beaconstudios 8y ago
        he had a package called kik, which npm dropped for the benefit of kik the company (though I don't know whether they requested they do so). In response the author unpublished everything from npm.
- jonreem 8y ago
  “You can please some of the people all of the time, you can please all of the people some of the time, but you can’t please all of the people all of the time”
- QuantumGood 8y ago
  This is mitigated if enough notice can be given in advance.

Novashi 8y ago

>I think this is the clearest, easiest, correct answer. If you no longer have the time and motivation to maintain a project, and are also not in a position to hand over control to someone you have good reason to trust, the easy, safe answer is to retire it, and have others fork. To prescribe some preventative advice based on this: it's probably not a good idea if your project gets popular to continue being a solo developer in open source. So plan ahead based on your popularity. And your project isn't likely to explode in popularity over-night and be a dependency for 1000+ other projects, so you should be able to see this coming. Of course, this is super-easy to prescribe in hindsight.

wpietri 8y ago

I 100% guarantee you that if he did that, he'd be getting a lot of static about how he should have handed the package over to some contributor.

danso 8y ago
Which other similar situations are you thinking of?
- Rotten194 8y ago
  left-pad
  - mifreewil 8y ago
    left-pad was a very different situation. The maintainer unpublished the module from npm. I forget the reason, but I want to say it was some sort of rage quit.
    - beaconstudios 8y ago
      he had a package called kik, which npm dropped for the benefit of kik the company (though I don't know whether they requested they do so). In response the author unpublished everything from npm.
jonreem 8y ago
“You can please some of the people all of the time, you can please all of the people some of the time, but you can’t please all of the people all of the time”
QuantumGood 8y ago
This is mitigated if enough notice can be given in advance.