> Its unrealistic to closely follow the development of every package you are using. You've just abdicated all responsibility here! It is realistic -- not to me

> Its unrealistic to closely follow the development of every package you are using. You've just abdicated all responsibility here! It is realistic -- not to mention being the core part of our job -- to closely follow the development of ALL code in your application. No matter whether you wrote it, your coworker wrote it, or it was written by a volunteer halfway around the world, if it's running YOUR application, it's YOUR code. You've just chosen to outsource the maintenance of said code to someone you've never met and have no intention of paying. If you wouldn't pick some random asshole off the street to sit down at your desk and mess around in your production environment without at least peeking over their shoulder, why would you take some random stranger's code and shove it in your codebase without vetting it? So yes, it IS possible and IT IS YOUR JOB to follow the development of all the code that runs your system. That random asshole off the street offering you code for free owes you nothing more.