reiz

In the first version of the chart I had column for "XML". But it didn't looked good, because there was only 1 candidate for XML and that was Maven. That's why I dropped it again. Beside that I think that XML is kind of overkill for dependency management. JSON is just fine, much smaller and easy to read. Having the dependency definition in native code (Python, Groovy, whatever) is not a good decision, in my opinion, because that's a source for security vulnerabilities.

Good point. I will take that thought into the next blog post. The next blog post will cover CPAN and Nuget, too.

I'm sorry for that. But I'm getting every day requests for Bower, CocoaPods and Nuget. I don't get so many requests for CPAN. But It's on my radar and I will update the blog post somewhere this year.

Thanks for the hint. I really didn't know that. I will update the blog post with my new knowledge. One point more for Bundler/RubyGems :-)

I have read that blog post a couple days before. To sad. I think the people don't sign their Gems because it's some extra work and developers are lazy. I bet the artifacts in Maven are only signed because it's mandatory. You can not submit a unsigned artefact to search.maven.org. They will decline it. But in the intranets of many companies their are a lot of self hosted Maven Repositories and believe me, nobody is signing the Jars their!

If we want to have more security in the Ruby community then there is only one way. RubyGems has to decline every unsigned Gem. Signing Gems must be mandatory.

Yes. That's what I meant.

Actually I'm using in my daily work more Bundler and Maven. But I'm anyway a big fan of NPM.

I talked to many C devs, and they all use some kind of linux native package managers. For example apt-get or yum or RPM.

But the mirror posted their doesn't work for me. I get always a Forbidden message: http://mirror1.prod.rhcloud.com/mirror/ruby/. Or is it just me?

Maybe I was not clear enough on that point. Of course Lein is using a Maven Repository as backend. But the official Clojure Repository is not search.maven.org it is https://clojars.org. And there is no Mirror of clojars.org. Of course it's possible to mirror it, because it's a Maven Repo. But currently nobody is doing that.

It's currently the only solution. There not alternatives. It's cool that they build it, but currently it has many weak points. I hope they will add user auth and some kind of validation soon.

PIP and Python is on the list. Look at PyPI.

Thanks for the note. Actually I don't know why I wrote it like an acronym. I should now it better!

Nuget is on my radar. I will update the blog post in a couple months with Nuget and CPAN. It just takes some time.

No. There is no clear winner. The point is to show how other communities are solving this problem. By comparing them you get maybe new ideas.

NPM is doing a pretty good job. If they would sign their packages and make the licenses mandatory it would be the clear winner. Only 2 points are missing.

Yes. I think comparison is possible and important. Of course dependencies are handles in every language a bit differently. But on the other side they all do the same, more or less. The differences are more on the client side.

PIP is a good tool. But in my opinion the definition of dependencies shouldn't be in setup.py file. Because it's too easy to execute random code in a setup.py. A JSON file is the better choice for a project file, in my opinion.

We are constantly adding new package managers to our system. CPAN and Nuget are already on our radar. We will update the blog post in a couple months with them.

I was hanging out at Reddit and https://devcharm.com/.

VersionEye - Berlin - http://www.versioneye.com We are a tech company from Berlin, working with Ruby on Rails, JavaScript and MongoDB. Currently we are looking for a freelance designer who can create some awesome badges. We want to have different badges for the status of open source libraries. For more details send and email to contact@versioneye.com or contact us on Twitter: https://twitter.com/VersionEye

We are currently working on exactly that. The idea is that we check your dependencies every time you push to GitHub. Here is the current status of that hook: https://github.com/github/github-services/pull/727. I hope to get it done next week.

Not surprised about that. Hope that more people will use open source. It's the best way to prevent security leaks in software.

I just checked out the side. Didn't know it before. I found some interesting content. It's now part of my feedly. Thanks for the hint man.

There is http://www.12designer.com/en/. Which is similar to 99Designs.

Still not sure about that. If you have to pay tax for it it's just another currency. A currency with cool features! But I'm not sure if this is the end. I think something better will come after bitcoin.

I have them all in a text file and the text file is encrypted with an gnupg key.

At first I would do something what is not related to software development. I would try out something completely new. Maybe creating a new food brand for a niche market.

Thanks for your feedback. I know what you mean. VersionEye has already a pretty good GitHub integration. Currently we are working on automated change logs. And I want to work together with TravisCI and CodeShip to run tests against newest versions. I think together with automated testing it can be very valuable. I maintain a couple open source projects by myself. And I don't release new versions just for fun. Releasing a new version is a lot of work. If I do it than there is always a very good reason for it. For example BugFixes, SecurityFixes, New Features or Speed & Memory Optimisation. And I think if somebody else is releasing a new version of an open source project he has the same reasons. And that are all good reasons for me to update. That's why I started VersionEye.

I am running http://www.versioneye.com. Currently don't earn much with it. Most people are using it for open source projects. Still thinking about how to monetise it right. Any ideas?

Being able to read and control other peoples mind.

Pushing every day commits to GitHub is easier than writing blog posts every week. But I wish you all the best man! Keep it up.