6 ms·

Can we talk about why projects need to be actively maintained and extended indefinitely? Cairo paints things. It does a good job of it. What's wrong with it? Le

by cirno 6y ago

Can we talk about why projects need to be actively maintained and extended indefinitely? Cairo paints things. It does a good job of it. What's wrong with it? Leave it on Git, accept pull requests, check it once a week/month, you're good.

adamjb 6y ago
Sounds like we've got a volunteer!
- indolering 6y ago
  Exactly. For all of the wailing and gnashing of teeth around replacing X windows with Wayland, no one has stepped up to maintain X.org since Red Hat stopped funding its development. Old code isn't bad because its old, its bad because engineers decided it wasn't worth the minimal effort required to accept and release security fixes.
  - jolmg 6y ago
    Exactly? Their comment doesn't follow at all. cirno asks why continued development is necessary. That isn't addressed at all by telling them to volunteer. They're asking why anyone at all needs to do that. The point being that cairo should be very mature and stable by now.
    - saalweachter 6y ago
      I think the problem is that metaphors have legs. We like to talk about software as architecture. You design a thing. You build a thing. It is built. Except, real architecture doesn't work that way, and it turns out metaphoric architecture doesn't either. If you walk down the street long enough you will eventually see a house that is unmaintained. It wasn't broken to begin with, and no one broke it outright, but over time the paint (and shingles) have peeled, rot has set in, and now the foundation is cracked and the frame is starting to sag. Even maintenance isn't always safe. Sometimes you're up on the cathedral, fixing the roof, someone flicks a cigarette butt the wrong way and it doesn't matter how well it was architected 800 years ago, it's on fire now. We thought our digital creations were free from the decay or physical ones are subject to, but it turns out we were wrong, because even if the bits themselves don't actually rot, the digital environment they are living in constantly changes, and it amounts to the same thing.
  - orra 6y ago
    Accepting security fixes isn't sufficient to keep software secure. In the past few years X.org had some major ancient holes discovered. If the authors of the fixes hadn't bothered writing the fixes, I doubt many other people would have stepped up.
    - indolering 6y ago
      I mean, agreed! But in my mind X windows itself is a major security hole: every application can snoop on keyboard and mouse input of every other application. Beyond simple bug fixes, Wayland is the next step in fixing the more fundamental issues with X.org's architecture.
nwah1 6y ago
Even that kind of minimal effort is probably not worth it and provides a false sense of an active project capable of patching security vulnerabilities and so on.
- jolmg 6y ago
  > false sense of an active project capable of patching security vulnerabilities and so on Development seems active. Last MR/PR merged in was 2 days ago[1]. Isn't all that's lacking is someone to pack changes into a tarball and call it a release? [1] https://gitlab.freedesktop.org/cairo/cairo/-/merge_requests?scope=all&utf8=%E2%9C%93&state=merged https://gitlab.freedesktop.org/cairo/cairo/-/merge_requests?...
  - qwerty456127 6y ago
    > someone to pack changes into a tarball and call it a release Can't this be automated?
    - nl 6y ago
      Please go right ahead...
      - qwerty456127 6y ago
        I would, but I have zero skills in bash and in make and rather low skills in C. Aren't these the technologies used here? I doubt people would appreciate if I wrote them build scripts in Scala ;-)
  - ncmncm 6y ago
    As the Brits say, "Good man!". Meaning, you just volunteered.
necubi 6y ago
Something as foundational and important as a 2d canvas library is never going to be "finished" and can't just be abandoned aside from the occasional security fix. Examples of things you would need to have added in the past few years to stay competitive: * Vulkan support * Emoji support (although I'm not familiar enough with Cairo to know if shaping is part of the library) * Rendering in compute shaders * New platform support (like MacOS arm or Android) Already many users have switched to Skia which continues to make progress in all of these areas (and which is much faster).
- Lammy 6y ago
  > (although I'm not familiar enough with Cairo to know if shaping is part of the library) That would be its sister project Pango: https://blogs.gnome.org/mclasen/2019/05/25/pango-future-directions/ https://blogs.gnome.org/mclasen/2019/05/25/pango-future-dire... https://bugzilla.redhat.com/show_bug.cgi?id=1753295 https://bugzilla.redhat.com/show_bug.cgi?id=1753295
- jolmg 6y ago
  Why does it need development of new features to not be dead? Calling it dead implies that projects that are currently using it shouldn't use it anymore, but projects for which cairo as-is suffices will continue to work with the features that cairo already has, so why would they need to migrate?
  - binarycodedhex 6y ago
    Consumer-oriented novelty obsession (new == better + secure) and code churn "job security." If something works and is quality for what it does, it works. Does "ls" really need to be perpetually maintained with minor, inconsequential refactorings if it already works perfectly? If something has bugs or lacks features, then it needs maintenance. "Maintenance" for pushing out versions to fulfill expectations of "maintained" is pointless.
  - necubi 6y ago
    If I'm deciding what library to use, I'm not only concerned with whether it meets my needs today, but also whether it will meet my needs in a year or two. I don't necessarily know what those will be but I want to know that the core libraries I'm relying on will keep up with the industry so that my application isn't left behind without a costly rewrite. Just as a simple example, if my competition is using a non-dead rendering library and their UI is twice as fast as mine as a result, I'm not going to be happy.
LukeShu 6y ago
> Leave it on Git, accept pull requests, check it once a week/month, you're good. That's exactly it, this is essentially a contributor saying "hey, there are a bunch of contributions, can a maintainer please check in this month?" If you don't check in once a week/month, then you're not good.
- danilocesar 6y ago
  This reminds me those managers who use to say "It's just a little 'IF' here and there" and you find out a lot of hidden/broken corner cases.
tln 6y ago
You missed "release new versions". Which apparently this project can't do anymore...
- qwerty456127 6y ago
  Why would anybody even need releases anyway? Why not just clone and build the repo as it is? Most of the AUR repository packages seem to do just that.
accurrent 6y ago
Uhhhh.... Not at this scale. Thats what I thought about one of my previous open source projects. I was a naive highschool kid back then I thought open source is great. Let anyone use it. Yay! The one fine day someone raised a PR (this was back in 2012 when CI was not very common). It looked OK and I merged it. The following weeks had me battling issues with people using the library. Eventually I abandoned the project cause I didn't have the time/funds/motivation to continue working on it and there were better solutions available on the market.
- yxhuvud 6y ago
  Perhaps it is a sign the project is too large and need to be broken up in more manageable parts?
  - accurrent 6y ago
    In my case the problem was: High school kid who is good at coding != software engineer (there are many other nuances to SE, including team management/planning/etc.) In Cairo's case: Waaaaay too many projects depend on Cairo as a dependency either through GTK+ or otherwise. You will be breaking heaps of backwards compatibility.

by cirno 6y ago

adamjb 6y ago

Sounds like we've got a volunteer!

indolering 6y ago
Exactly. For all of the wailing and gnashing of teeth around replacing X windows with Wayland, no one has stepped up to maintain X.org since Red Hat stopped funding its development. Old code isn't bad because its old, its bad because engineers decided it wasn't worth the minimal effort required to accept and release security fixes.
- jolmg 6y ago
  Exactly? Their comment doesn't follow at all. cirno asks why continued development is necessary. That isn't addressed at all by telling them to volunteer. They're asking why anyone at all needs to do that. The point being that cairo should be very mature and stable by now.
  - saalweachter 6y ago
    I think the problem is that metaphors have legs. We like to talk about software as architecture. You design a thing. You build a thing. It is built. Except, real architecture doesn't work that way, and it turns out metaphoric architecture doesn't either. If you walk down the street long enough you will eventually see a house that is unmaintained. It wasn't broken to begin with, and no one broke it outright, but over time the paint (and shingles) have peeled, rot has set in, and now the foundation is cracked and the frame is starting to sag. Even maintenance isn't always safe. Sometimes you're up on the cathedral, fixing the roof, someone flicks a cigarette butt the wrong way and it doesn't matter how well it was architected 800 years ago, it's on fire now. We thought our digital creations were free from the decay or physical ones are subject to, but it turns out we were wrong, because even if the bits themselves don't actually rot, the digital environment they are living in constantly changes, and it amounts to the same thing.
- orra 6y ago
  Accepting security fixes isn't sufficient to keep software secure. In the past few years X.org had some major ancient holes discovered. If the authors of the fixes hadn't bothered writing the fixes, I doubt many other people would have stepped up.
  - indolering 6y ago
    I mean, agreed! But in my mind X windows itself is a major security hole: every application can snoop on keyboard and mouse input of every other application. Beyond simple bug fixes, Wayland is the next step in fixing the more fundamental issues with X.org's architecture.

nwah1 6y ago

Even that kind of minimal effort is probably not worth it and provides a false sense of an active project capable of patching security vulnerabilities and so on.

jolmg 6y ago
> false sense of an active project capable of patching security vulnerabilities and so on Development seems active. Last MR/PR merged in was 2 days ago[1]. Isn't all that's lacking is someone to pack changes into a tarball and call it a release? [1] https://gitlab.freedesktop.org/cairo/cairo/-/merge_requests?scope=all&utf8=%E2%9C%93&state=merged https://gitlab.freedesktop.org/cairo/cairo/-/merge_requests?...
- qwerty456127 6y ago
  > someone to pack changes into a tarball and call it a release Can't this be automated?
  - nl 6y ago
    Please go right ahead...
    - qwerty456127 6y ago
      I would, but I have zero skills in bash and in make and rather low skills in C. Aren't these the technologies used here? I doubt people would appreciate if I wrote them build scripts in Scala ;-)
- ncmncm 6y ago
  As the Brits say, "Good man!". Meaning, you just volunteered.

necubi 6y ago

Something as foundational and important as a 2d canvas library is never going to be "finished" and can't just be abandoned aside from the occasional security fix. Examples of things you would need to have added in the past few years to stay competitive: * Vulkan support * Emoji support (although I'm not familiar enough with Cairo to know if shaping is part of the library) * Rendering in compute shaders * New platform support (like MacOS arm or Android) Already many users have switched to Skia which continues to make progress in all of these areas (and which is much faster).

Lammy 6y ago
> (although I'm not familiar enough with Cairo to know if shaping is part of the library) That would be its sister project Pango: https://blogs.gnome.org/mclasen/2019/05/25/pango-future-directions/ https://blogs.gnome.org/mclasen/2019/05/25/pango-future-dire... https://bugzilla.redhat.com/show_bug.cgi?id=1753295 https://bugzilla.redhat.com/show_bug.cgi?id=1753295
jolmg 6y ago
Why does it need development of new features to not be dead? Calling it dead implies that projects that are currently using it shouldn't use it anymore, but projects for which cairo as-is suffices will continue to work with the features that cairo already has, so why would they need to migrate?
- binarycodedhex 6y ago
  Consumer-oriented novelty obsession (new == better + secure) and code churn "job security." If something works and is quality for what it does, it works. Does "ls" really need to be perpetually maintained with minor, inconsequential refactorings if it already works perfectly? If something has bugs or lacks features, then it needs maintenance. "Maintenance" for pushing out versions to fulfill expectations of "maintained" is pointless.
- necubi 6y ago
  If I'm deciding what library to use, I'm not only concerned with whether it meets my needs today, but also whether it will meet my needs in a year or two. I don't necessarily know what those will be but I want to know that the core libraries I'm relying on will keep up with the industry so that my application isn't left behind without a costly rewrite. Just as a simple example, if my competition is using a non-dead rendering library and their UI is twice as fast as mine as a result, I'm not going to be happy.

LukeShu 6y ago

> Leave it on Git, accept pull requests, check it once a week/month, you're good. That's exactly it, this is essentially a contributor saying "hey, there are a bunch of contributions, can a maintainer please check in this month?" If you don't check in once a week/month, then you're not good.

danilocesar 6y ago
This reminds me those managers who use to say "It's just a little 'IF' here and there" and you find out a lot of hidden/broken corner cases.

tln 6y ago

You missed "release new versions". Which apparently this project can't do anymore...

qwerty456127 6y ago
Why would anybody even need releases anyway? Why not just clone and build the repo as it is? Most of the AUR repository packages seem to do just that.

accurrent 6y ago

Uhhhh.... Not at this scale. Thats what I thought about one of my previous open source projects. I was a naive highschool kid back then I thought open source is great. Let anyone use it. Yay! The one fine day someone raised a PR (this was back in 2012 when CI was not very common). It looked OK and I merged it. The following weeks had me battling issues with people using the library. Eventually I abandoned the project cause I didn't have the time/funds/motivation to continue working on it and there were better solutions available on the market.

yxhuvud 6y ago
Perhaps it is a sign the project is too large and need to be broken up in more manageable parts?
- accurrent 6y ago
  In my case the problem was: High school kid who is good at coding != software engineer (there are many other nuances to SE, including team management/planning/etc.) In Cairo's case: Waaaaay too many projects depend on Cairo as a dependency either through GTK+ or otherwise. You will be breaking heaps of backwards compatibility.