3 ms·

I feel he may be overthinking it.. people just want to understand the best options available for their use-case. If you see a project with no new commits for 3

I feel he may be overthinking it.. people just want to understand the best options available for their use-case. If you see a project with no new commits for 3 years (1), you would rather not invest time trying to get it working if there is a newer/maintained project. 1 And whilst you may argue the software is "finished", reality is very little software survives without maintenance. Unless you have zero dependencies and future exploits in no way apply.

swiftcoder 2y ago
> Unless you have zero dependencies and future exploits in no way apply. This was the default for most software up until maybe a decade ago, when everything-in-the-cloud software-as-a-service ate the world
flohofwoe 2y ago
pystring [1] is such a "finished" project, they even have a note in the readme that the project is not dead (I guess they got a lot of such questions too). It's a small yet complete library with a very narrow focus, so there really is nothing to change once it's done (and despite that recently merged CI pipeline having failed on macOS for some reason, it works just fine there, I make heavy use of pystring in one my projects across Windows, macOS and Linux). Quote: "Note: Despite the infrequent updates, this repo is not dead/abandoned - just stable! We use it every day at Imageworks." [1] https://github.com/imageworks/pystring https://github.com/imageworks/pystring
- Timshel 2y ago
  I like that the example you gave has a merge less than a year ago :) and more than 10 in 2022.
  - flohofwoe 2y ago
    ...OTH just 54 commits over 16 years ;) Most of the more recent commits seem to be project scaffolding (build system, CI support etc).
bayindirh 2y ago
As a person who writes code for himself, I generally write a note about the state of the repository. In my case, if there's no commit for three years, this means that code is in production for at least three years, and is not broken on any of my systems, so nothing is being updated. This is generally result of my (sometimes unreasonable) effort to write everything with absolute minimum number of libraries, and vendoring of the libraries I use. So, clone, (optionally) compile, use. If it doesn't work for you, let me know. We can work something out, as long as it's reasonable.
- theshrike79 2y ago
  Yep, I've got some self-made python glue that's been running for at least half a decade with zero changes. It's all in Github and there haven't been any commits because it's doing its current job with 100% precision and I don't need a single additional feature.
palata 2y ago
> I feel he may be overthinking it.. people just want to understand the best options available for their use-case. As I understand it, that is the point of the author: people feel the need to "ping" the maintainer because they don't really understand how open source works. But receiving a "pong" does not mean it is "more maintained", does it? You could ask "is this project maintained?", I could answer in the minute "yes, it is!", then you could ask for a feature and I would just not implement it for free. In the end, before choosing to depend on a project, you should ideally read the code base and decide whether you would feel comfortable modifying it (fixing a bug or adding a feature) yourself. If not, maybe it would be less risky for you to write your own code. And if you can't do that, then you have to accept that you rely on code that is out of your depth, and choose whether it is a risk you are willing to take or not.
- Ferret7446 2y ago
  > But receiving a "pong" does not mean it is "more maintained", does it? It does, potentially (though I don't disagree that most people would misinterpret it). It means there is someone there, who you could potentially ask some questions nicely and get an answer (e.g., "Why is this line of code here?").

swiftcoder 2y ago

> Unless you have zero dependencies and future exploits in no way apply. This was the default for most software up until maybe a decade ago, when everything-in-the-cloud software-as-a-service ate the world

flohofwoe 2y ago

pystring [1] is such a "finished" project, they even have a note in the readme that the project is not dead (I guess they got a lot of such questions too). It's a small yet complete library with a very narrow focus, so there really is nothing to change once it's done (and despite that recently merged CI pipeline having failed on macOS for some reason, it works just fine there, I make heavy use of pystring in one my projects across Windows, macOS and Linux). Quote: "Note: Despite the infrequent updates, this repo is not dead/abandoned - just stable! We use it every day at Imageworks." [1] https://github.com/imageworks/pystring https://github.com/imageworks/pystring

Timshel 2y ago
I like that the example you gave has a merge less than a year ago :) and more than 10 in 2022.
- flohofwoe 2y ago
  ...OTH just 54 commits over 16 years ;) Most of the more recent commits seem to be project scaffolding (build system, CI support etc).

bayindirh 2y ago

As a person who writes code for himself, I generally write a note about the state of the repository. In my case, if there's no commit for three years, this means that code is in production for at least three years, and is not broken on any of my systems, so nothing is being updated. This is generally result of my (sometimes unreasonable) effort to write everything with absolute minimum number of libraries, and vendoring of the libraries I use. So, clone, (optionally) compile, use. If it doesn't work for you, let me know. We can work something out, as long as it's reasonable.

theshrike79 2y ago
Yep, I've got some self-made python glue that's been running for at least half a decade with zero changes. It's all in Github and there haven't been any commits because it's doing its current job with 100% precision and I don't need a single additional feature.

palata 2y ago

> I feel he may be overthinking it.. people just want to understand the best options available for their use-case. As I understand it, that is the point of the author: people feel the need to "ping" the maintainer because they don't really understand how open source works. But receiving a "pong" does not mean it is "more maintained", does it? You could ask "is this project maintained?", I could answer in the minute "yes, it is!", then you could ask for a feature and I would just not implement it for free. In the end, before choosing to depend on a project, you should ideally read the code base and decide whether you would feel comfortable modifying it (fixing a bug or adding a feature) yourself. If not, maybe it would be less risky for you to write your own code. And if you can't do that, then you have to accept that you rely on code that is out of your depth, and choose whether it is a risk you are willing to take or not.

Ferret7446 2y ago
> But receiving a "pong" does not mean it is "more maintained", does it? It does, potentially (though I don't disagree that most people would misinterpret it). It means there is someone there, who you could potentially ask some questions nicely and get an answer (e.g., "Why is this line of code here?").