2 ms·
The first signal I look for is how well will it actually solve my problem. Do I have to hack around how it works to integrate it or is it straight forward. Th
by ishjoh 8y ago
The first signal I look for is how well will it actually solve my problem. Do I have to hack around how it works to integrate it or is it straight forward.
The second signal I look at is activity. If a project hasn't had a commit somewhat recently, then there is a good chance it's not actively worked on, or does not serve a very large audience.
To be clear, not having a large audience isn't always an issue, every project starts with 0 forks, but it's always tough relying on a project that has open Pull Requests sit un-merged simply because the original author has abandoned the project.
If the project has a small user base, the third signal I try to use is to look through some of the code base and documentation. Can I jump in and make a fix, or is the code style so esoteric that it would take me a long time to grok.
- riyakhanna1983 8y agoDo you also evaluate its security posture?
- ishjoh 8y agoI try to, unfortunately security is typically the hardest to measure. If the projects documentation specifies security as a goal of the project, I always look at that kindly, but most projects don't list that as a major goal.