Dumb Ways for an Open Source Project to Die

kept by eddie may 20

The piece enumerates dozens of distinct ways open-source projects become effectively dead, from maintainer abandonment to sabotage and ecosystem shifts.

Turn Dependabot off
Dependabot's version-based security alerts are noisy and less effective than static analysis tools that check reachability of vulnerable functions.
also on Dependabot, #open-source, #software-engineering, #developer-tools
Package Managers Need to Cool Down
A survey finds that while many package managers and update tools have adopted dependency cooldowns to prevent supply chain attacks, implementations vary wildly in naming, scope, and timestamp handling, and major ecosystems like Go, Maven, and Gradle still lack support.
also on Dependabot, #open-source, #developer-tools
Before GitHub | Armin Ronacher's Thoughts and Writings
Armin Ronacher argues that as GitHub declines due to instability and product churn, open source must preserve its history by moving to decentralized, archivally-funded homes that avoid the pre-GitHub era's fragility.
also on npm, GitHub, #tech-community, #open-source, #software-engineering, #developer-tools
GitHub - sindresorhus/np: A better `npm publish`
np enhances npm publish with interactive UI, safety checks, version bumping, tagging, and rollback features for reliable package releases for developers.
also on npm, GitHub, #open-source, #software-engineering, #developer-tools