8 ms·

> One of the problems is that GitHub is full of OSS libraries where the last commit was three years or more ago and you have no idea (without forensically analy

> One of the problems is that GitHub is full of OSS libraries where the last commit was three years or more ago and you have no idea (without forensically analysing commits, issues, etc.) whether it's because the project is done or because the maintainer(s) lost interest, had other priorities, etc. I don't think there's any at least medium sized project that is considered to be done but not abandoned/legacy and does not receive any commits. Any non-trivial project that has no commit since the last three years is abandoned. Even in the case a project is considered to be done/finished, in order to not abandon it you have to maintain it: fix security issues, update outdated dependencies, update tooling so that you can still run/compile with non outdated tools and so on.

detaro 6y ago
That really depends on what the project is I think (and I guess what you consider non-trivial). I can easily see e.g. a numerical library not really needing maintenance of that sort.
jasonkester 6y ago
You might benefit from flipping this around and asking yourself why you're not able to ship software that remains shipped without intervention. And why you can't even imagine a world where that would be possible. If you spend some time and effort removing whatever obstacles you have in place that are keeping you from being able to do that, you'll have a lot more free time to spend building new things. For what it's worth, this world does in fact exist. And there are lots of us living in it. Here's hoping you find a way to join us!
- scoopertrooper 6y ago
  So your projects have no dependencies? You just write everything from scratch? Your code is perfect the first time you write it? I'm utterly confused by this comment.
  - DougBTX 6y ago
    A project can't be more stable than its dependencies and tooling, but that doesn't mean that the only way to be stable is to have no dependencies. Some programming languages make guarantees that old code will build in new versions (eg, ISO C even refuses to introduce new warnings for code that would previously build without warnings), while others will introduce backwards incompatible changes in minor releases. How much maintenance a project needs after it is "done" really depends on the tooling environment.
    - scoopertrooper 6y ago
      Library and framework maintainers will eventually stop updating previous major versions. So you manage to tread water just fine till your major version reaches EOL, then you've found yourself in the position of having to change over to a completely new API on a schedule set by the maintainer of the dependency.
      - hdjdbtbgwjsn 6y ago
        It depends on the language. Fortran last broke backwards compatibility with F90. F77 code is still 100% supported. C is similar.
        pas 6y ago
        As far as I know Java too. That doesn't mean it's still best practice to write code that uses unsafe/deprecated constructs.
      - dragonwriter 6y ago
        > Library and framework maintainers will eventually stop updating previous major versions. And, if it's open source and it's easier than switching to a new dependency, you can just adopt maintenance of the dependency—not necessarily generally, just enough to address any bugs induced in or evolution in needs for the project(s) you have that depend on it.
    - dragonwriter 6y ago
- skywhopper 6y ago
  Wow! What software is this that is complete and doesn’t need maintenance? Based on my experience, it must be either very simple or very uninteresting.
  - smabie 6y ago
    You mean like TeX?
    - pas 6y ago
      How do people use TeX nowadays? Is that part of the whole LaTeX ecosystem? How big is the userbase?
  - ThrowawayR2 6y ago
    Embedded systems, particularly small ones, often don't even have a means of being updated.
- sheetjs 6y ago
  > If you spend some time and effort removing whatever obstacles you have in place that are keeping you from being able to do that This is literally impossible for many JS libraries. Chromium / NodeJS / other JS environments are themselves constantly changing. Irrespective of the evolving timezone info, the core MomentJS can only be "done" for a particular set of browser versions. Each bug pertaining to dates, like https://bugs.chromium.org/p/v8/issues/detail?id=7863 https://bugs.chromium.org/p/v8/issues/detail?id=7863 , is a potential browser/engine version for which Moment needs a fix. > this world does in fact exist It only exists for certain proprietary software and SaaS developers because of the hard work of open source developers to keep up with the changing landscape. If everyone adopted your attitude, you would be forced to contend with the true nature of the ecosystem directly.
  - Wowfunhappy 6y ago
    This is true, but also it would be good if the JS environments stopped doing that.
    - pas 6y ago
      If the Web, browsers, the JS lang, sandboxing, Internet protocols, TLS, etc. were all perfect and done, then JS envs would be too.
wruza 6y ago
>in order to not abandon it you have to maintain it: fix security issues, update outdated dependencies, update tooling so that you can still run/compile with non outdated tools and so on. If you step back a little, you can see a "positive" feedback loop. The entire issue is that maintainers have to catch crazy rabbits who have no rest, change things and abandon "old" versions that worked but were not perfect. Perfect is the enemy of good.
JD557 6y ago
>I don't think there's any at least medium sized project that is considered to be done but not abandoned/legacy and does not receive any commits. As another commenter mentioned, this can be pretty common in math libs. Here's an example: https://github.com/fommil/netlib-java https://github.com/fommil/netlib-java This project BLAS/LAPACK/ARPACK bindings for JVM languages. The repository is marked as archived and the owner explicitly states that the project is done. The last commit was 21 Jun 2017. This project is still heavily used, there are still multiple libraries that use those bindings.
- tutfbhuf 6y ago
  The README.md contains install instructions for Debian and Ubuntu, these tend to outdate (not work) quite fast with newer versions of the distributions. Also if any of the low-level libraries BLAS, LAPACK or ARPACK updates, then the wrapper might not continue to work with newer versions or is stuck on a legacy version including bugs and security issues 4 ever. > This project is still heavily used, there are still multiple libraries that use those bindings. Heavily used does not imply that a dependency is not abandoned.
sokoloff 6y ago
I was hoping to use Tex as the counter example here, because it’s a large system that’s remarkably stable. However, it’s not actually a counter example as there are small commits periodically. So I’ll post here admitting to be wrong in my instinct. https://www.tug.org/svn/texlive/ https://www.tug.org/svn/texlive/
- nathell 6y ago
  That's TeX Live, a distribution of TeX. TeX: The Program has had its most recent release in January 2014.
  - sokoloff 6y ago
    Thanks. I was noodling around on my phone trying to find it and landed there incorrectly.
hinkley 6y ago
There are a couple of projects I track where more than half of the commits are just updating dependencies or compatibility information. It's both a responsible thing to do and a form of virtue signalling. Yes, we are still here.

detaro 6y ago

That really depends on what the project is I think (and I guess what you consider non-trivial). I can easily see e.g. a numerical library not really needing maintenance of that sort.

jasonkester 6y ago

You might benefit from flipping this around and asking yourself why you're not able to ship software that remains shipped without intervention. And why you can't even imagine a world where that would be possible. If you spend some time and effort removing whatever obstacles you have in place that are keeping you from being able to do that, you'll have a lot more free time to spend building new things. For what it's worth, this world does in fact exist. And there are lots of us living in it. Here's hoping you find a way to join us!

scoopertrooper 6y ago
So your projects have no dependencies? You just write everything from scratch? Your code is perfect the first time you write it? I'm utterly confused by this comment.
- DougBTX 6y ago
  A project can't be more stable than its dependencies and tooling, but that doesn't mean that the only way to be stable is to have no dependencies. Some programming languages make guarantees that old code will build in new versions (eg, ISO C even refuses to introduce new warnings for code that would previously build without warnings), while others will introduce backwards incompatible changes in minor releases. How much maintenance a project needs after it is "done" really depends on the tooling environment.
  - scoopertrooper 6y ago
    Library and framework maintainers will eventually stop updating previous major versions. So you manage to tread water just fine till your major version reaches EOL, then you've found yourself in the position of having to change over to a completely new API on a schedule set by the maintainer of the dependency.
    - hdjdbtbgwjsn 6y ago
      It depends on the language. Fortran last broke backwards compatibility with F90. F77 code is still 100% supported. C is similar.
      - pas 6y ago
        As far as I know Java too. That doesn't mean it's still best practice to write code that uses unsafe/deprecated constructs.
    - dragonwriter 6y ago
      > Library and framework maintainers will eventually stop updating previous major versions. And, if it's open source and it's easier than switching to a new dependency, you can just adopt maintenance of the dependency—not necessarily generally, just enough to address any bugs induced in or evolution in needs for the project(s) you have that depend on it.
  - dragonwriter 6y ago
skywhopper 6y ago
Wow! What software is this that is complete and doesn’t need maintenance? Based on my experience, it must be either very simple or very uninteresting.
- smabie 6y ago
  You mean like TeX?
  - pas 6y ago
    How do people use TeX nowadays? Is that part of the whole LaTeX ecosystem? How big is the userbase?
- ThrowawayR2 6y ago
  Embedded systems, particularly small ones, often don't even have a means of being updated.
sheetjs 6y ago
> If you spend some time and effort removing whatever obstacles you have in place that are keeping you from being able to do that This is literally impossible for many JS libraries. Chromium / NodeJS / other JS environments are themselves constantly changing. Irrespective of the evolving timezone info, the core MomentJS can only be "done" for a particular set of browser versions. Each bug pertaining to dates, like https://bugs.chromium.org/p/v8/issues/detail?id=7863 https://bugs.chromium.org/p/v8/issues/detail?id=7863 , is a potential browser/engine version for which Moment needs a fix. > this world does in fact exist It only exists for certain proprietary software and SaaS developers because of the hard work of open source developers to keep up with the changing landscape. If everyone adopted your attitude, you would be forced to contend with the true nature of the ecosystem directly.
- Wowfunhappy 6y ago
  This is true, but also it would be good if the JS environments stopped doing that.
  - pas 6y ago
    If the Web, browsers, the JS lang, sandboxing, Internet protocols, TLS, etc. were all perfect and done, then JS envs would be too.

wruza 6y ago

>in order to not abandon it you have to maintain it: fix security issues, update outdated dependencies, update tooling so that you can still run/compile with non outdated tools and so on. If you step back a little, you can see a "positive" feedback loop. The entire issue is that maintainers have to catch crazy rabbits who have no rest, change things and abandon "old" versions that worked but were not perfect. Perfect is the enemy of good.

JD557 6y ago

>I don't think there's any at least medium sized project that is considered to be done but not abandoned/legacy and does not receive any commits. As another commenter mentioned, this can be pretty common in math libs. Here's an example: https://github.com/fommil/netlib-java https://github.com/fommil/netlib-java This project BLAS/LAPACK/ARPACK bindings for JVM languages. The repository is marked as archived and the owner explicitly states that the project is done. The last commit was 21 Jun 2017. This project is still heavily used, there are still multiple libraries that use those bindings.

tutfbhuf 6y ago
The README.md contains install instructions for Debian and Ubuntu, these tend to outdate (not work) quite fast with newer versions of the distributions. Also if any of the low-level libraries BLAS, LAPACK or ARPACK updates, then the wrapper might not continue to work with newer versions or is stuck on a legacy version including bugs and security issues 4 ever. > This project is still heavily used, there are still multiple libraries that use those bindings. Heavily used does not imply that a dependency is not abandoned.

sokoloff 6y ago

I was hoping to use Tex as the counter example here, because it’s a large system that’s remarkably stable. However, it’s not actually a counter example as there are small commits periodically. So I’ll post here admitting to be wrong in my instinct. https://www.tug.org/svn/texlive/ https://www.tug.org/svn/texlive/

nathell 6y ago
That's TeX Live, a distribution of TeX. TeX: The Program has had its most recent release in January 2014.
- sokoloff 6y ago
  Thanks. I was noodling around on my phone trying to find it and landed there incorrectly.

hinkley 6y ago

There are a couple of projects I track where more than half of the commits are just updating dependencies or compatibility information. It's both a responsible thing to do and a form of virtue signalling. Yes, we are still here.