Upstream vendors can harm small projects | Hacker News Reader