"Critical" projects and volunteer maintainers [LWN.net]

"Critical" projects and volunteer maintainers

Posted Aug 3, 2022 17:09 UTC (Wed) by LtWorf (subscriber, #124958)
In reply to: "Critical" projects and volunteer maintainers by developer122
Parent article: "Critical" projects and volunteer maintainers

AFAIK there is no way to remove or take over abandoned packages.

I maintain one such package in debian and basically the original author stopped maintaining it and I can' make updates because I don't have the permissions. Pypi has no way to ever reclaim or remove it.

Also, today I found the module "typing-inspect". It's marked as alpha by the author. It has about 800000 daily downloads. It seems people do not read the flags that already exist when adding a dependency, so I don't think one more flag would change anything (except add hassle to people publishing libraries).

I'd be in favour of signing uploads, but it seems that the world has decided that learning to use gpg (or a graphical frontend) is hard, before even trying.

In my experience, people tend to pin dependencies. It seems typedload's recent versions are mostly ignored, while an older and much slower version from 2019 is the most downloaded by far.

to post comments

"Critical" projects and volunteer maintainers

Posted Aug 3, 2022 18:04 UTC (Wed) by mathstuf (subscriber, #69389) [Link]

> It seems people do not read the flags that already exist when adding a dependency, so I don't think one more flag would change anything (except add hassle to people publishing libraries).

It seems to me based on my reading of the description that it is perma-alpha:

> The “typing_inspect” module defines experimental API for runtime inspection of types defined in the standard “typing” module.

"Critical" projects and volunteer maintainers

Posted Aug 4, 2022 11:37 UTC (Thu) by kleptog (subscriber, #1183) [Link]

While people may not read the flags on a project, people are using tools like safety to warn them about security issues. If such tools could be configured to also warn about abandoned packages, unauthenticated packages and the like it would at least raise some visibility. NPM for example notifies when projects are seeking donations for example (though no idea how well that works).

Business are taking supply chain risks more and more seriously these days, so increasing awareness might be just enough to get some businesses to devote resources into fixing the problem.