Hacker News Reader

That’s just silly. Suppose someone doesn’t want to maintain a package any longer, retires or dies?

I think the implication here is that you probably shouldn't be using unmaintained packages. I guess you can at your own risk.

I challenge you to audit all dependencies and, particularly, the sub-dependencies of those. Most people, in my experience, look at a requirements.txt or package.json and think that’s everything but your dependency tree is going to be easily 3-4x that size.

Node.js is particularly notorious for this. It’s a big challenge for having non-flat dependency management and there’s no great solution for this problem.

Well, I don't use Node.js and I'm careful about cargo dependencies, so I actually can do this with every project I have worked on, and I value the ability to do it. It has led to a lot more sleep, as I understand it, than people with critical projects that rely on npm get. Cargo doesn't exactly have the all of the problems that npm has, but it is already kind of time consuming to audit your dependencies in Rust.

Sure, you can do it. But, have you? I'm betting not, and I think that's the point.

Reply on news.ycombinator.com