38 ms·

> If a project hasn't gotten a new commit in 2 days then the project is claimed dead. That is certainly true, those projects are effectively dead. They lack se

> If a project hasn't gotten a new commit in 2 days then the project is claimed dead. That is certainly true, those projects are effectively dead. They lack security updates, lack integrations with new platforms, lack support for new HW architectures, lack newer privacy guarantees, etc., etc.

JoshTriplett 10mo ago
That's what I'd expect if I see a project with no commits in 2 years. Not 2 days.
- goodpoint 10mo ago
  There's ton of perfectly usable 2-years old software.
  - geraldwhen 10mo ago
    I suspect that CVE inflation has poisoned the minds of many developers. A db driver may have an issue with unsanitized user input when run against SQLite, but you only use it with oracle and sanitize input anyway, but that shows up as a 9.1 critical deployment blocker for corporate employees. Unexploitable CVEs with inflated ratings make using any open source software a pain in the butt at BigCo.
    - goodpoint 10mo ago
      Old does not mean vulnerable.
dokyun 10mo ago
Snake oil
wtetzner 10mo ago
Maybe some of them. There are plenty of old projects that still build and run fine.
drnick1 10mo ago
Certainly that depends on the nature of the software. For instance, I don't expect some header-only library that does what it's supposed to do to ever need updating.
- locknitpicker 10mo ago
  > Certainly that depends on the nature of the software. For instance, I don't expect some header-only library that does what it's supposed to do to ever need updating. If it's a headers-only library in a language such as C++, if the project is not dead then the very least anyone would expect from it is being updated to support any of the modern C++ versions. Also, if the project is actively maintained then there is always a multitude of low-priority issues and features to address. Being FLOSS also means anyone in the whole world is able to contribute anything. If no one bothers to do so, that is aligned with the fact the project is indeed dead.
  - SkiFire13 10mo ago
    > If it's a headers-only library in a language such as C++, if the project is not dead then the very least anyone would expect from it is being updated to support any of the modern C++ versions. Did I miss a new C++ version released <2 days ago perhaps?
    - locknitpicker 10mo ago
      > Did I miss a new C++ version released <2 days ago perhaps? You certainly are missing something. C++26 was officially released 4 months ago, and support is slowly being rolled out to compilers and packages. https://en.cppreference.com/w/cpp/compiler_support/26.html https://en.cppreference.com/w/cpp/compiler_support/26.html If you somehow believe this kind of work is done in a couple of days, that's a good way to explain to the world how oblivious you are about the topic you are discussing.
      - lelanthran 10mo ago
        > If you somehow believe this kind of work is done in a couple of days, that's a good way to explain to the world how oblivious you are about the topic you are discussing. And, in turn, you appear to be oblivious to the point - the release cadence of this best-case scenario still means like a decade between updates to the project. C++26 was released 4months ago; pointless to update it until compilers and deps are updated. So, best case is maybe you'll have complete bug-tested support in the supported compilers in 2030. If we're looking at 2035-ish for the next release, we're still only looking at 2040 before you update. You still have to take into account that updating might not even be necessary. It's not like C++ < C++26 suddenly doesn't work.
SkiFire13 10mo ago
> They lack security updates Very few projects update dependencies that often, and only very big ones are found with security issues that often. > lack integrations with new platforms You don't need a new intration _every 2 days_, not to mention that many projects don't need such integrations at all. Moreover some popular and updated projects lack such integrations despite having lot of commits. > lack support for new HW architectures This is something that many projects get for free. But also, you don't get a new HW architecture every 2 days. > lack newer privacy guarantees What more privacy guarantees do I need from projects that don't communicate with external services or store data at all?
- hombre_fatal 10mo ago
  People who are earnestly engaging with their point have assumed “two days” was hyperbole so that they can instead respond to the greater idea, yet you have not: you’re stuck on an unserious detail like it’s the lynchpin of their claim.
anthk 10mo ago
TCL/Tk 8.6, AWK, tons of shells, SDL2 versions, OpenMotif releases frozen in time... As they stated, tons of 'renewed' stuff are snake oil today. They add nothing new.

JoshTriplett 10mo ago

That's what I'd expect if I see a project with no commits in 2 years. Not 2 days.

goodpoint 10mo ago
There's ton of perfectly usable 2-years old software.
- geraldwhen 10mo ago
  I suspect that CVE inflation has poisoned the minds of many developers. A db driver may have an issue with unsanitized user input when run against SQLite, but you only use it with oracle and sanitize input anyway, but that shows up as a 9.1 critical deployment blocker for corporate employees. Unexploitable CVEs with inflated ratings make using any open source software a pain in the butt at BigCo.
  - goodpoint 10mo ago
    Old does not mean vulnerable.

dokyun 10mo ago

Snake oil

wtetzner 10mo ago

Maybe some of them. There are plenty of old projects that still build and run fine.

drnick1 10mo ago

Certainly that depends on the nature of the software. For instance, I don't expect some header-only library that does what it's supposed to do to ever need updating.

locknitpicker 10mo ago
> Certainly that depends on the nature of the software. For instance, I don't expect some header-only library that does what it's supposed to do to ever need updating. If it's a headers-only library in a language such as C++, if the project is not dead then the very least anyone would expect from it is being updated to support any of the modern C++ versions. Also, if the project is actively maintained then there is always a multitude of low-priority issues and features to address. Being FLOSS also means anyone in the whole world is able to contribute anything. If no one bothers to do so, that is aligned with the fact the project is indeed dead.
- SkiFire13 10mo ago
  > If it's a headers-only library in a language such as C++, if the project is not dead then the very least anyone would expect from it is being updated to support any of the modern C++ versions. Did I miss a new C++ version released <2 days ago perhaps?
  - locknitpicker 10mo ago
    > Did I miss a new C++ version released <2 days ago perhaps? You certainly are missing something. C++26 was officially released 4 months ago, and support is slowly being rolled out to compilers and packages. https://en.cppreference.com/w/cpp/compiler_support/26.html https://en.cppreference.com/w/cpp/compiler_support/26.html If you somehow believe this kind of work is done in a couple of days, that's a good way to explain to the world how oblivious you are about the topic you are discussing.
    - lelanthran 10mo ago
      > If you somehow believe this kind of work is done in a couple of days, that's a good way to explain to the world how oblivious you are about the topic you are discussing. And, in turn, you appear to be oblivious to the point - the release cadence of this best-case scenario still means like a decade between updates to the project. C++26 was released 4months ago; pointless to update it until compilers and deps are updated. So, best case is maybe you'll have complete bug-tested support in the supported compilers in 2030. If we're looking at 2035-ish for the next release, we're still only looking at 2040 before you update. You still have to take into account that updating might not even be necessary. It's not like C++ < C++26 suddenly doesn't work.

SkiFire13 10mo ago

> They lack security updates Very few projects update dependencies that often, and only very big ones are found with security issues that often. > lack integrations with new platforms You don't need a new intration _every 2 days_, not to mention that many projects don't need such integrations at all. Moreover some popular and updated projects lack such integrations despite having lot of commits. > lack support for new HW architectures This is something that many projects get for free. But also, you don't get a new HW architecture every 2 days. > lack newer privacy guarantees What more privacy guarantees do I need from projects that don't communicate with external services or store data at all?

hombre_fatal 10mo ago
People who are earnestly engaging with their point have assumed “two days” was hyperbole so that they can instead respond to the greater idea, yet you have not: you’re stuck on an unserious detail like it’s the lynchpin of their claim.

anthk 10mo ago

TCL/Tk 8.6, AWK, tons of shells, SDL2 versions, OpenMotif releases frozen in time... As they stated, tons of 'renewed' stuff are snake oil today. They add nothing new.