Consequently any decision to use such an API seems to require one first read and review the entire implementation of the API, otherwise you get the experience t

Consequently any decision to use such an API seems to require one first read and review the entire implementation of the API, otherwise you get the experience that NetFlix had. There's no getting around this, you or someone that you trust (not necessarily at your company) needs to read and review both the API, and implementation details for open source software that you use. Open source software isn't a hardware store you can dip into to get the latest parts that you need for your project. Adding a dependency makes your code depend on other peoples code. Just like internal code should go through a code review, so should external dependencies. This also explains why for a lot of companies, it's easier to write their own thing rather than need to keep on top of other people's changes. I happened to write about this yesterday which explains my thoughts further http://danielcompton.net/2014/11/19/dependencies http://danielcompton.net/2014/11/19/dependencies.