3 ms·
Reading about Keycloak and how long it is taking to patch critical vulnerabilities, I wonder is CNCF becoming how Apache was - where abandoned open source softw
by RcouF1uZ4gsC 2y ago
Reading about Keycloak and how long it is taking to patch critical vulnerabilities, I wonder is CNCF becoming how Apache was - where abandoned open source software goes to die.
- teepo 2y agoI think that CNCF has better handle on abandonware, plus really good observably. https://devstats.cncf.io/ https://devstats.cncf.io/
- pphysch 2y agoHopefully the Keycloak thing will spur more competition. I looked at some alternatives and settled on Keycloak because it was "obviously" the mature and hardened solution. Well, clearly not.
- preisschild 2y agoI think being a CNCF project is better than not being one. It gives it more visibility and structure and thus is less likely to be abandoned. But sure, unfortunately if not enough different companies and individiuals are maintaining stuff it gets abandoned.
- caniszczyk 2y agoLast I checked, Keycloak has increased in activity since joining CNCF... https://keycloak.devstats.cncf.io/d/1/activity-repository-groups?orgId=1&from=now-2y&to=now https://keycloak.devstats.cncf.io/d/1/activity-repository-gr... CNCF has probably 20x the funding of the ASF and is a different organization that spends millions of dollars on security audits, events and more, you can read about it in our annual report: https://www.cncf.io/reports/cncf-annual-report-2023/ https://www.cncf.io/reports/cncf-annual-report-2023/ Also we actively remove/prune projects that aren't active... we will probably archive ~10 this year https://www.cncf.io/project-metrics/ https://www.cncf.io/project-metrics/