Hacker News Reader

Comment by jongjong | Hacker News Reader

I can relate to the frustration of the author. I wrote an open source library which gets downloaded 50K+ times per week. At one point, I hadn't updated it in several months and people started asking if the project is dead... In fact, it wasn't updated in a while because it had been working perfectly and was built in a forward-compatible way; that makes it more healthy and therefore more alive than probably 99% of libraries on the internet.

The expectation that software libraries or frameworks should break every few months is disturbing. I think this may be due to the fact that many of the most popular frameworks do this. I find that React-based apps tend to break every few months for a range of reasons; often because of reliance on obscure functionality or bundling of binaries which aren't forward-compatible with newer engine versions.

View on HN

> The expectation that software libraries or frameworks should break every few months is disturbing

I think it is more that recent updates are used as a proxy for determining if the developer still cares about the project.

The problem is it is hard to distinguish between a project that has been abandoned, and a project that is feature complete and hasn't had any bugs reported in a while.

Although, if you assume that any software is free of bugs, and that at least some users will report bugs, if there is low activity, that suggests that either it isn't well maintained, or there isn't a critical mass of users to find and report those bugs. But then, higher quality software will require a higher number of users to hit that critical mass so it doesn't give you that much information unless you also know how good the software is.

Maintainer's activity in GitHub issue is also a good metric.

I disagree. I have some common lisp libraries that have not been touched in years and the majority of my day to day is in company git.

I imagine that I am not the only one.

If your using a non-github platform without mirroring the repository, your pretty SoL for getting those green squares of activity to reflect your actual activity.

SoL?

Shit outta luck

Shit outta luck.

Is that really a measure of activity, because i'm 90% sure i saw tools to fake that into some kind of image.

Edit: https://github.com/blaise-io/contribution

For example.. I guess that maybe gaming the system really is required if thats a 'good measure'.

Why should i care about the green squares (which can be faked anyway)? This feels like microsoft propaganda to get me to put everything on github for no good reason, especially considering that if he's pushing to a company git that company probably doesn't want it on the public internet.

First thing I was taught when I was introduced to a CL codebase/project..

"Library/repository activity has little to do with usability, or quality. Some things are more or less finished and correct."

I have code running today for which my last commit (in CVS!) was in 2002.

Some software just does what it is supposed to and doesn't need to change, and this is OK, and I have no idea why this fact infuriates some people.

Because people these days tend to have the attention span of squirrels.

I wouldn't be surprised if most software in the world has been chugging along unchanged for decades. I suspect future historians in 1000 years will find pieces of ancient code copied around unchanged for centuries.

I mean one way to so it would be to just write: I consider this project complete and have it running ever since

Well, does that mean "i will never touch this again" or "I won't add any new features, but I will fix bugs"? If the former, I probably don't want to use it. If the latter, I might consider it, depending on what it does, and if it has the features I need, but then, again, how do I know if they are still watching it since they posted that.

And there is also the state of "it has all the features I need, but I'd be open to adding a new feature if someone else shows a compelling use case for it."

I mean it depends on the kind of project right? What would be catastrophic for a web framework could be totally normal for a command line tool. I mean when was the last commit to some of the GNU utils we use every day? If your module provides math functions or implements some protocoll chances are those underlying things are not going to change etc.

I use a ton of tools I wrote myself and haven't had to touch in years except for the occasional dependency update.

> when was the last commit to some of the GNU utils we use every day?

17 hours ago: https://github.com/coreutils/coreutils/commits/master

Sure, because the repo contains a ton of tools. Yet another advantage of the monorepo: if everything is in one repo nobody will notice that you haven't touched that one part of the code since you wrote it.

Or let's phrase it differently: there will always be a part of the code that you do not have to touch for decades if all goes well. And if that part sits in a seperate repo, is it abandoned or just finished?

Maybe a bot that once every three months (or whatever time period you prefer) does a commit to the changelog that says "I am [not] still maintaining this project" and it sends you an email a week before to hit a toggle to remove the "not". Then in the readme you can put a paragraph saying "I use Maintaina-bot (tm), and I commit to clicking the button every three months as long as I'm maintaining this project".

It's a little silly, but I could imagine that if this become a common enough thing, people would start to trust it.

This is already available in reverse: you can mark a repository as unmaintained in GH to let people know you wont touch it anymore.

My thinking is that someone forgetting about a project, not caring about it, or for some reason being unable to update it (e.g. losing access to an account or even being physically unable due to injury or death) might not update the project to indicate this; I think a lot of the wariness of older projects that haven't been recently touched is because it's hard to tell the difference between "no changes need to be made so I'm leaving it untouched but monitoring" and "no one is even looking at this and if a change needs to be made, no one knows".

You can update copyright comments once a year.

You should only do that if you have changed something. Otherwise you are falsely extending the period before the work enters the public domain.

Someone will then come up with "Maintaina-bot-bot", so that we don't have to bother clicking that button.

Programmers are lazy creatures.

The laziness (which I have no issues admitting I also have!) is exactly why I think having to explicitly act each time to indicate ownership is important; otherwise, it would be impossible to tell the difference between software that's maintained but hasn't needed updates from something that no one is maintaining anymore, which is the issue we have now.

I think a mix of your suggestion + https://news.ycombinator.com/item?id=32994453 might be good, no?

All abandoned projects were active at some point in the past. A project being active now is not a guarantee it will stay so. What happens if the project is abandoned after you chose to rely on it?

> What happens if the project is abandoned after you chose to rely on it?

Fork it and start maintaining it with other people depending on it.

An active project is more likely to stay active than an abandoned project to become less abandoned. See also the Lindy effect.

> What happens if the project is abandoned after you chose to rely on it?

If the project already had the features you need, was thoroughly tested and debugged, and was built with almost no dependencies (only relying on a small number of very stable platform APIs), then it might not matter even if it was already abandoned when you started using it.

Case in point: On a recent software project, I took dependencies on two Lua libraries which were already abandoned. Their source code was short and readable enough that I had no problem going through it to understand how they worked. In one case, I added an important feature (support for a different type of PostgreSQL authentication to a Postgres client library). I also packaged both libraries for my Linux distro of choice and submitted them to the official package repositories. If anyone reports bugs against the version which I packaged, I'll fix them, but it seems unlikely that many bugs will ever be found.

As the OP rightly pointed out, the expectation that software libraries should normally need to be constantly updated is ridiculous. Many other things invented by humans stay in use for decades with no alterations. Beethoven's 5th symphony hasn't had any updates in more than 200 years.

> Beethoven's 5th symphony hasn't had any updates in more than 200 years.

What a shame it’s been abandoned and no other musician stepped up to take over the work.

> Many other things invented by humans stay in use for decades with no alterations. Beethoven's 5th symphony hasn't had any updates in more than 200 years.

I don't understand this argument. Are you saying that some things don't require updates, therefore we shouldn't expect software libraries to be updated as well? But there are also things that do require updates or maintenance. Would that invalidate the argument?

Some examples of things that need updates or maintenance: buildings, infrastructure, tools, machinery. Even immaterial things like books or laws receive updates.

And that includes the 5th Symphony too, which has different editions.

Re-reading the comment as a whole might help to correct this "strawman" interpretation, but anyways, here is some clarification:

In today's world of software development, many take it as given that every software library should receive periodic updates, and that a library which has not been recently updated is in some sense "dead" and should not be used.

This is logical in cases where the domain is itself constantly changing. For example, software packages which calculate the results of income tax returns must be updated yearly, because the tax laws change. Similarly, packages which perform time zone calculations must be periodically updated, because the time zone rules change.

However, a vast number of software libraries operate in domains which are not inherently subject to change. As an arbitrary example, imagine a hypothetical library which performs symbolic differentiation and integration. Since the rules for how to integrate a function do not change, once thoroughly tested and debugged, there is no reason why such a library could not be used unaltered for decades. Yes, it might not benefit from the development of more efficient algorithms; but if the library was already more than fast enough for a certain application, that might not matter.

While software is different from other things created by humans, the existence of creative works such as books or musical compositions, which often survive for decades or centuries despite not receiving regular updates, provides an illustration of what can and should be possible for software as well. Note, this is an illustration and not an argument.

"If the former, I probably don't want to use it."

I guess that really depends on what it is.

The older I get, the more change-averse I become. That doesn't mean that everything is perfect and we shouldn't fix things that are broken, but it does mean I start to embrace the philosophy of "don't fix what isn't broken" more and more.

If I have something installed on my desktop / workstation that a) is not network attached and b) is not exploitable from a security point of view (least privileges, no sensitive data) c) has little risk of corrupting data and d) is unlikely to "just stop working" one day because of a systems / dependency update ... then I'm not in any hurry to update it. When I do get around to it it's probably because I'm installing a new version of Linux and so everything is getting an update. But if the old version still works, has no bugs or security risks and there's been no updates for years ... who cares?

I can think of several categories of applications that fall into this category:

- Music / mp3 player

- Classic Shell / Open Shell for Windows

- Office software, like LibreOffice. I'm sure newer versions offer some niceties but things "just work" for me. I don't see the reason to upgrade.

- Almost every game, ever (assuming it's stable and has no major usability bugs that need patching)

- Lots more

Things I do want to upgrade would be my web browser, operating system kernel, anything network attached. Really anything that could affect data integrity or security. Other than that, I'm lazy, comfortable and I don't want to risk the introduction of breaking changes.

> That doesn't mean that everything is perfect and we shouldn't fix things that are broken,

Okay, so this is exactly what GP said. There is a difference between "not adding new features" and "not fixing bugs".

Not to get into a semantic argument about specific words and their meanings, but my broader point is that there are certain categories of bugs where I wouldn't care if they ever got fixed or not. Maybe this is nit-picking and maybe it's my cynical brain coming out of 25 years of software development where people can't even seem to agree on what constitutes a "bug" vs a "change request" half the time, or how we prioritize the severity of bugs etc. but my point is that sometimes "it's not broken" means "it's good enough."

Would I be upset if the developer "fixed" these categories of bugs? Of course not. But would I avoid using the software at all if they never did?

...

"I guess that really depends on what it [the software in question] is."

...what?

What does it matter if the developer still cares about the project?

It isn't crashing and no new features are needed. If it did then the project wouldn't be complete.

We're not talking about some early access half broken NPM package here, the blog specifically talks about a completed product.

What if you do find a critical bug after you started using it, and there is no one around that can help you with it?

When you find no one paying for maintainance, then congratulations: you are the maintainer !

Agreed and upvote but it becomes a problem if the owner is unresponsive but still holding the main repository, domains, package repositories etc. Forking is possible but a very complicated, messy, hostile path and also a lot more work than just contributing a patch.

If you want an SLA on support, then pay for support. It's literally that simple.

This is a fantasy ... go offer some open source maintainer some money to implement something they don't want or care about and come back and tell us if it was simple. It may be in some cases where they are actively looking for that kind of work, but more than likely they will have no interest.

I would expect for many developers it is really only a matter of how much you are willing to pay. If they don't already do freelance work then that cost might reasonably be higher than what it would cost to hire someone else to implement it because of the extra tax paperwork and whatnot that they now need to deal with.

Of course there will be some maintainers who are simply not interesed or unable to offer paid support (e.g. due to their employer being a control freak) but that's ok. As others have pointed out, forking / maintaining out of tree patches (and providing them to others) is not inherently hostile.

If there are no updates, then even forking should be light overhead.

Forking is trivial and non-hostile. Is there a plumbing issue in your language where it is unreasonably difficult to wire other dependencies to your fork instead of the original?

> a lot more work than just contributing a patch.

For you it is.

But for a maintainer, reviewing and accepting a pull request can still be a lot of work, especially if the code has been stable for a long time.

> The problem is it is hard to distinguish between a project that has been abandoned, and a project that is feature complete and hasn't had any bugs reported in a while.

Usually I browse the issues / bug reports page and see if there are any breaking bugs that aren't getting much attention. If there are, then that's one more data point that the project might be abandoned.

Speaking to GitHub specifically:

1) The owners sometimes archive the project or write in the readme: complete, no more features will be accepted.

2) You can look at the number of open issues. A project with X stars/used-by/forks that hasn't been updated in 8 months and has zero open issues is probably stable.

The annoying thing about software is that we still haven't quite gotten the transfer of knowledge working to the point that you can communicate all knowledge about a piece of software purely through code (and no, being able to emulate all behaviour is not the same, otherwise decompiling wouldn't be a thing).

What this means is that for most software an essential part of that software consists of knowledge that needs to be kept alive. The only proof people can have of this is activity surrounding the project. This puts us in the uncomfortable position of having to designate someone as the 'keeper of all knowledge' surrounding a project if it is to be sustained, and failing to do so will result in knowledge being irrevocably lost.

I think it depends heavily on the coding style. In many corporate environments, developers tend to obfuscate or over-engineer or they will tend to introduce too much complexity into the project.

If you have source, you can figure it out. If there's something clever in source that isn't obvious, that's either a problem, or a well documented exception to the rule.

If your whole entire source code is so innovative that you can't immediately understand it, there might be trouble, but so much code is or can be pretty boring.

At most, changing something will make a bug that's not really in the spec but is something everyone wants and relies on, but isn't immediately obvious, then you'll have to fix it.

The trouble is that if knowledge is lost, people will probably not bother to figure it out, and starting fresh might be more appealing.

The bigger issue especially in open source is that if there's no activity, there might not be any in the future. It could be abandoned for 10 years and perfectly fine, until a change is needed, and even if the change is easy and the knowledge is there, it might not happen if nobody cares anymore, and you'll have to fork it yourself, so maybe you choose the actively maintained thing even if it's less complete or more complex or ugly to use.

Even if you have source, you can't necessarily figure it out. Sure, you can figure out what the program does, but you can't know precisely what the program was intended to do, or how closely the current version matches that eventual goal.

Sure, you might have the specification that the original developer was given, but every developer brings their own opinions and hard-won experience to a project. Just because the specification says "outgoing messages are sent to a queue" and the program links with ZeroMQ, doesn't tell you whether that's a design goal or a temporary stop-gap proof-of-concept. Maybe the program is structured so it can use an email queue for distributed operation. Maybe the program is designed to be linked into a larger system and just push message structs onto an in-memory vector.

I think a better way to go about it is to state your own goals. If you want it to bridge it to ZeroMQ, you can evaluate the program and see if the way it is coded fits you. If you want another service, you evaluate how much work to retrofit it. As longs as you expect decades out of your software, you should prepare to own all your dependencies. The intention of the original developer does not matter that much.

What a program does at the moment is exactly what it should do, unless there's a bug report filed, or the current developers want it to do something else.

Whatever it was originally meant to do is probably either obsolete, or well known to all users, if it's been so long the original devs left.

If it's got ZeroMQ, and has for 5 years, one can probably assume someone will be upset if it suddenly does not have ZeroMQ.

Regardless of intent, for practical purposes, if people are using it, they probably want that to stay around until you do an orderly transition to some other thing.

Are you confusing software dependencies for the semantics of a running program?

If I understand your point correctly, software dependencies are absolutely part of a running program.

It's exceedingly rare that you would not be able to figure it out given the source code. The real question is whether you have the time.

I think if a project was that important, the people who needed something patched would be able to get it together even if the original maintainer went missing.

The original analogy to the challenges of knowledge transfer isn't totally applicable. Knowledge transfer is important to organizations because figuring everything out all over again would be costly, not because it would be impossible.

why does coding have to do with opinions and such? coding is about code. pure logic. fuck opinion. useless as a metric, as a standard.

None of us are coders as far as I know, I don't think that's a real job title. They call us programmers or developers or engineers.

We solve problems with code, or by finding ways to avoid writing code.

We translate vague requirements into things a computer can handle, or we translate between computer languages, because any spec that was complete would just be the program. That's why they keep us. The computers can do pure logic on their own.

Opinion is very much a part of it because pure logic is just a useless pile of text unless it has something to do with the real world, which is full of opinions.

Even inside the program itself, we aren't dealing with logic. Languages are designed for human minds, and compilers are meant to catch mistakes people make. Libraries are often chosen for all kinds of perfectly good nontechnical reasons, like "That one is actually maintained" or "Everyone already knows this" or "People seem to like this" or "That seems like it won't be a thing in 3 years".

As long as you are relying on the software, what you do care about is what it does today, which you get from the source.

You certainly care about what it will do tomorrow too (so you can keep up, or avoid having it break stuff for you), but if it goes unmaintained, you don't have to worry about that since it does the job for you.

OTOH, I've been on projects where a dependency was chosen on the promise of what they will do in the future. That future never materialized, so we were left with a bunch of unfinished dependency code, maintained a bunch of components ourselves etc — it was a mess, in short. So I never rely on promises, only on what's there today.

Very much so. I've spent a lot of time trying to decipher code and the biggest questions are usually "why is it doing this" and "what's this large piece of code indended to do".

Reverse-engineering all that can be an utter nightmare even with tests. I suggest that people who disagree consider, for example, the word "reverse-engineer" as in how they might reverse-engineer a car.

Usually you have this kind of problem when it's NOT producing desired results and the problem is how to make it do something that's needed without affecting some set of usecases that you don't understand yet.

Software would be a point in space. There are multiple types of documentation which can either justify why the point would be where it is, or what direction it should move in.

The problem with not updating dependencies for a long time is that it can force you to make sudden version jumps if something like a CVE is discovered.

At my company we had a real scramble to upgrade log4j when the CVE for that came out. A lot of software was many versions behind. Luckily for us, no breaking changes had been made, and it was simply a matter of bumping the version to the latest one.

That was a lucky break, because if that had been a library like Jersey or Spring it would have been an entirely different ballgame.

If you don't keep your builds up to date, you open yourself up to risks like that, which are unknown and to some extent unknowable.

I think communicating this information in your README or whatever might help a lot. It's hard to know if something is finished or abandoned in general, so a message indicating the former would help people arrive at a decision sooner.

I think one of the core issues contributing to fragile, continuously-updated software is a culture of over-using dependencies. Each dependency added is a potential complexity trap. Using a dependency that has few sub-dependencies is less likely to cause problems. Or that has several sub-dependencies that each have no dependencies. It's deep dependency trains that are likely to cause this. Ie, dependencies that depend on multiple others.

> The expectation that software libraries or frameworks should break every few months is disturbing.

Dependecies and external APIs change so software breaks.

An example from a project of a customer today: Ruby had a Queue class up to 3.0.2. For some reason they moved it to Thread::Queue since 3.1.0. It's only a name change but it's still one release to do.

Depends on your choice of language and framework etc though? The js ecosystem is very break-y and, at least when I worked with it, so was the Ruby/RoR ecosystem. In .net or Java, far less so; we have almost 10 year old software which we can update the libs off and it compiles and runs the tests just fine.

Even Java broke things between java 8 and 9

With flags to recover the previous behavior, and the changes of which only broke code using non-public API surface, i.e.: code that should never have been using those APIs but which previously had no way to prevent usages.

> With flags to recover the previous behavior

I'm not sure what flags you are referring to, but that might be because I went from 8 to 11 and skipped 9 and 10.

> the changes of which only broke code using non-public API surface

The APIs weren't non-public. They were publicly documented. They did say they were internal and you should avoid them, but they were still used in libraries and referenced in tutorials and stack overflow answers. And if you happened to transitively use a library that used one of those APIs, it would cause a fair amount of pain when you upgraded.

They were non-public, at least all the ones that I recall being broken (from memory, but let me know if I’ve missed something important here: URLClassLoader, Base 64 classes (made public under a different name), unsafe: name implies the contract to some extent, but also still available under a flag. Then there’s the whole slew of things like DNS resolvers that override internal classes, but again- weren’t supposed to be for “public” consumption.

Ultimately, the break seems to have been intentional, but did receive appropriate consideration. Mark’s comments about moving forward do address these points.

Modularization "broke" a few public APIs since they had to remove an interface declared in swing from some classes outside of the package. I am not sure if there is even one known case of anyone being affected by that change.

I don’t know the details of your particular library but I think 50k/week downloads and no problems is an outlier. In my experience even projects with small audiences tend to accumulate outstanding bug reports faster than they’re fixed.

I’m sure you’re right, but it sounds like it’s an outlier not by random chance, but because it was built carefully.

I think there’s a useful lesson there.

I can confirm that this is the norm for all my open source projects. Forward-compatibility issues can be easily avoided by not using too many dependencies and by carefully checking dependencies before using them.

I check for things like over-engineering and I check out the author (check their other libraries if there are any).

What non-game-able metrics do you think an outsider can use to evaluate the quality of a tool? In some ways a "perfect" tool would have no flaws (thus no issues/pull reqs) and be so easy to use (few training updates, SO questions) that it would appear to be dormant.

SQLite seems to hit a good balance. There's always something new but nothing particularly breaking (from my light usage POV), so it looks live.

Filed issues are getting radio silence, no matter their quality.

The author chimes in, says he’ll take a look next evening, then two years whoosh by.

There is an ambitious todo and nothing moves.

The code is in alpha for years, considered unstable, huge exclamation points in the readme that it should not be used, and yet somehow there are hundreds of reverse dependencies and it’s like this for years (usually should mean “RUN!!!”). Sometimes sneaky as it’s not a direct dependency for you, but for those two or three libraries used by like 80% of the ecosystem.

Built carefully, extremely tiny, or single purpose.

"Do one thing and do it well" - the unix philosophy, and why I still use cd, ls (dir on windows) today.

If a project exceeds two functions its probably doomed to become either redundant or broken.

If a project does one thing well, even if something else uses it, you can always decompose to it (your software is always useful, even when somebody writes the fancy bells and whistles version).

It's an open source pub/sub and RPC server/client (similar to gRPC) - It has a client and server component written with JavaScript and Node.js. I avoided using any dependency which relied on pre-built binaries. Also, I skim-read the code of all dependencies and made sure that they were well written and didn't use too many sub-dependencies. The trick is to minimize the number of dependencies and maximize their quality.

I 100% believe that’s it’s possible to build a library without tons of bugs, and appreciate that there’s people who put out quality libraries like yours.

I do think as a general heuristic no updates for 3 months means it’s been at least 2 months since anyone paid attention to outstanding bugs, especially the npm ecosystem.

It really depends on the size and complexity of the library. Do you think something like leftPad needed updates every month to perform its function as expected and remove bugs? Of course not, the mere suggestion is ridiculous, but also something like jQuery def needs constant upkeep. In the middle, there's a world of possibilities.

Leftpad shouldn't exist and any library using it as a direct dependency should be treated suspiciously.

I'm not saying that because of the leftpad fiasco, I mean that any library that small should simply be pasted into your codebase because the risk of managing the dependency outweighs the benefits.

I strongly agree with this. Another set of libraries I take issues with is gulp and its plugins. I find that gulp plugins keep breaking constantly and are often flagged with vulnerabilities. The sad thing is that these plugins solve very simple problems, there is no reason for them to keep breaking every few months for the last 5 years or so.

If I see a library which is supposed to solve a simple problem but it requires a large number of dependencies to do it, that's a big red flag which indicates to me that the developer who wrote it is not good enough to have their code included in my project - I don't care how popular that library is.

gulp itself is sort of abandonware and is dependent on libraries that have vulnerabilities (you judge yourself if they apply to you, if you run them on untrusted inputs etc). A remedy in my project was to rip it out altogether and replace it with shell commands.

Do you think something like leftPad needed updates every month to perform its function as expected and remove bugs?

Node libraries are a bit odd in that respect because package JSON files have an "engines" property that informs users about the minimum and maximum Node version the library works with. The author of leftpad could check its compatibility with each new version of Node that's released, and update the engines value version accordingly. That would be quite helpful because abandoned libraries that aren't known to be working with newer Node versions don't get updated, and users can user that information to look for something else.

What that means is that any Node library that isn't being updated as often as Node itself is probably not actively maintained, or the author isn't making full use of Node's feature set.

> "The author of leftpad could check its compatibility with each new version of Node that's released"

Really? This sounds feasible at all for you for all the millions libraries in npm not to be labelled as "obsolete"? Checking if string concatenation still works on every major node release and tagging it as such?

This sounds feasible at all for you for all the millions libraries in npm not to be labelled as "obsolete"?

Yes. I mean, they could just leave the max version of the engines property blank because it should always work if it's something as trivial as leftpad, but in a well-run package repository the work of checking library compatibility should be getting done. The fact that NPM is full of old libraries that haven't been tested in new versions of Node is a bad thing, and those libraries should be flagged as untested.

Can I get the name?

We have the same problem with our sass product: the product is "complete" in our minds, we don't want to add more features, make it more complicated, ... we perform minor updates of third-party components, some minor fixes, ... This means we don't maintain a blog with very recent posts, or a very active twitter. We have a daily usage counter on the homepage though, which shows that thousands of users use it these days. But from time to time someone still asks if the product is alive... We haven't found a solution to this yet: it's as if we are expected have a blog post every few days or weeks, create new stuff all the time, ...

Could you post release notes on Twitter and on your blog? That way users knew that the product is still currently supported

We do have a release notes page, but it's really not interesting content: updates of some third-party frontend or backend packages that users never actually see, fixed a typo, minor css alignment, ...

We do announce when there is a user-visible and significant issue or update, but that's quite rare, maybe once every 6 months or more.

Try opening an old project from 3-5 years ago that has a lot of dependencies like something from react-native, Django, etc. and you’ll find many of them impossible to even install without using the original Python or Javascript versions - that’s assuming the oldest dependencies are still available in the pinned versions.

It’s not a common use-case, I guess, but I had some old projects that I abandoned and wanted to try working on them again and found it almost impossible. The worst cases had dependencies which weren’t available unless I used an x86 laptop with an older version of Mac, because the packages were never built for arm laptops.

That's what version pinning and semver is for. If I install 1.2.3 in 2018, and the software is now 4.5.6, I don't expect it to work without updates.

In regards to the second case, bet that's Python with the wheels situation, where it doesn't fallback to building from source by default for some reason (instead throwing a super obtuse error), at least with Poetry.

I had to choose between two libraries at work, lead rejected my recommendation because github was showing less activities, the other project was seeing a total rewrite regularly, largely buggy because of that, and unclear documentations, yet it was the popular choice.

I think one issue, is that the world changes around an app or library. In these cases, the code base could need updating as a side effect of this change.

Also, not many people (especially me included) are able to write something that's perfect first time. In an ideal world, other developers would be testing and challenging what's been written; which would meant the product or library needs updating.

I think it's (perhaps ideally) likely, that at least one of these factors is relevant.

When evaluating libraries, recent activity is one of the things I look at. It's a far from perfect heuristic. I've probably rejected libraries like yours for what amounts to no very good reason.

I don't know if this is a good suggestion or not but I wonder if some form of "keepalive commit" might help here. I can imagine a few ways they might work, some simple, some more elaborate.

I don't check the commit history, I check the issue tracker. If something has unmerged bugfix patches from 3 years ago without any comment from the maintainer, I assume that it's just not being maintained.

I recently added a very visible note to the README.md of one of my projects that essentially said: "lack of commits means this is STABLE, not dead. Our plan for <next major runtime> is bla bla, in a year or so"

This expectation that things need to be committed to or updated every month has to stop, we're just wasting time and energy on stuff that is already fixed (unless there are security issues, of course).

Maybe GitHub needs to automatically include an UPDATES.md into each page, I dunno.

Well, there is also the security aspect in mind. Most software relies on libraries that repeatedly get CVEs over months (not years).

You might not care too much, and it clearly depends on the application, but for me updating a software that doesn't use anymore a library for getting user input that leads to a buffer overflow if you insert a certain character, or similar things (like remote code execution, etc.), can be quite important. Finally, apps are most of the time connected to the Internet, which makes them inherently vulnerable.

After searching "android software libraries CVEs" I found this in the first results' page: https://github.com/dotanuki-labs/android-oss-cves-research

It might be outdated, but the principle still applies.

It's very unlikely that your application is self-sufficient and doesn't need updates.

EDIT: I read the message from Apple as a "hopeful" attempt to say "come on, man at least update the dependencies".

> Well, there is also the security aspect in mind.

What security ? "Google security" where everyone except the user has access to his data ? Why does a note taking app needs internet to function ? Why does my phone app need access to internet ?

Those are great counterpoints. Instead of relying on developers to keep their own apps up to date (you will always have a significant number of outliers), you enforce security better at the system level. Having more tightly scoped permissions and better sandboxing of runtimes solves this way better than depending on individual app developers to secure their own apps.

how many note taking apps do you have? without even going on my phone, I think 70% of my apps need internet access (for a reason).

I understand your frustration, also thank you for your work.

> The expectation that software libraries or frameworks should break every few months is disturbing.

As a library user, it's hard to find a good balance between fully trusting a system to stay alive for a while without maintenance, while being super paranoid about every aspect I rely on. Mentally it's easier to expect it to break every now and then, than to keep thinking "it's probably fine, but I still need to be defensive about stuff that never happen".

I think the issue on a library being "alive" or not is best mitigated by the users being comfortable to fix it if it broke under their use case. There's libraries I thought were completely dead but were a good shortcut to where we wanted to go, and we expected to extend it here and there anyway. That can't work for everything (thinking of security libs in particular, I wouldn't want to touch them) but it's to me the ideal situation, with no undue stress on the lib maintainer as well.

If your product relies on any compilers/tools which are themselves updated, then at least your CI needs to be updated regularly enough. May be in your case, that was the case, but if not, then that would just to me that the product is not being maintained, even if the product is feature complete.

Depending on how you feel about it you could update the readme every so often with: [date] Checked project, still is ok in current form.

"I think this may be due to the fact that many of the most popular frameworks do this."

According to the OP, it is also due to companies controlling mobile OS such as Apple.

One of the things I like about non-corporate open source OS like NetBSD is I can run old userland utilities with new kernels without any problems.

I feel like, and hope gorhill responds to this, that uMatrix was similar to this. Done and stable and needing to be touched just so people can wouldn't ask if it was still maintained. (Pre manifestv3 that is)

Perhaps you should commit a new "Still working well..." line to its readme file in every few weeks to satisfy the update hungry crowd. :)

> built in a forward-compatible way

What do you mean by this?

Any general comments on how to write forward-compatible software for a hack programmer?

How do you think users would react to a monthly no-changes-required update?

Sounds like they consider the software to be complete. I that case an update provides no value.

An update provides no value except as a signal to users that the developer hasn't killed the project. I was wondering how annoyed or reassured users would be if they saw version x.x.x+1 with release notes noting no changes.

Please don't. A sentence like "I'm still around, don't have anything to release for now because the library is feature-complete and no bug has been found for a while" would be better.

If you have some kind of security review process for dependency updates, then this is annoying.

Reply on news.ycombinator.com