4 ms·

> As far as I know, it's also still standard practice in most companies to either read the source code of open-source stuff before deploying it to production (b

by chupy 11y ago

> As far as I know, it's also still standard practice in most companies to either read the source code of open-source stuff before deploying it to production (binary or build) or get a support contract from someone else who has. Reading the source code might be the case if you are in a large enterprise that can afford to keep those programmers busy or needs to actually vet the code but I honestly doubt it. Just check the loc count on something as common as Hadoop (close to 1 million [1]) and that is excluding the "stack" described in the article. I wanna bet you, because we all know how volatile the job market is that even the guys building or supporting the software did not write or read even half of that code. [1] https://www.openhub.net/p/Hadoop/analyses/latest/languages_summary https://www.openhub.net/p/Hadoop/analyses/latest/languages_s...

empressplay 11y ago
I suspect this is why when many companies decide they want to use open source stuff they contract with companies like GitHub, who absorb the risk of using git, etc, rather than trying to vet the code themselves. I still have a hard time envisioning anyone in any position of authority in any credible company accepting the idea of installing open source software without vetting it one way or the other. If the shit did hit the fan their career would be pretty much over.
- rockdoe 11y ago
  companies like GitHub, who absorb the risk of using git Except they don't do that at all? If a bug in git would cost your company a lot of money, why do you think GitHub would be accountable if you have some enterprise deal there? I still have a hard time envisioning anyone in any position of authority in any credible company accepting the idea of installing open source software without vetting it one way or the other. Well, that is an entirely different thing. People TEST stuff before deploying it. But that has little to do with code reading or mandatory support contracts.

by chupy 11y ago

empressplay 11y ago

I suspect this is why when many companies decide they want to use open source stuff they contract with companies like GitHub, who absorb the risk of using git, etc, rather than trying to vet the code themselves. I still have a hard time envisioning anyone in any position of authority in any credible company accepting the idea of installing open source software without vetting it one way or the other. If the shit did hit the fan their career would be pretty much over.

rockdoe 11y ago
companies like GitHub, who absorb the risk of using git Except they don't do that at all? If a bug in git would cost your company a lot of money, why do you think GitHub would be accountable if you have some enterprise deal there? I still have a hard time envisioning anyone in any position of authority in any credible company accepting the idea of installing open source software without vetting it one way or the other. Well, that is an entirely different thing. People TEST stuff before deploying it. But that has little to do with code reading or mandatory support contracts.