Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Backyourstack: discover and sponsor your open-source dependencies

backyourstack.com

Post reply on HN
Print view View original

31–40 of 65 posts

Re: Backyourstack: discover and sponsor your open-source dependencies

#31

Post by anoncoward111 »

ajdlinux wrote: post #28
znarfor wrote: post #13

Earlier quoted context omitted.

We effectively don't support Python yet but it should not be far away. It's 100% Open Source and we're looking for contributions. https://github.com/opencollective/backyourstack/issues/34

Understandable that you're adding support for languages and packaging ecosystems as you go, and JS + PHP is as good a place as any to start, but it would be helpful if this were explicitly highlighted. For those who are unfamiliar with the ecosystems in question, package.json and composer.json are just filenames that don't actually tell you anything.

It would be helpful, and the site creator should list it. However, let's not treat this as a fault. They're offering you a free service and can't launch with every issue already resolved before being identified.

Re: Backyourstack: discover and sponsor your open-source dependencies

#32

Post by is_true »

oliwarner wrote: post #20

> If you want to analyze non-public repositories, sign in with your GitHub account Do people really expose their or their employer's source code to random third party convenience services? I do understand the convenience factor here, I just think it's dodgy to encourage developers to be so flippant with privileged access.

That's a bit too much. Shouldn't even be an option.

Re: Backyourstack: discover and sponsor your open-source dependencies

#33

Post by anoncoward111 »

pferde wrote: post #16
Spacemolte wrote: post #14

Earlier quoted context omitted.

Consider how many layers of dependencies are in use today, and you have no idea who the commenter is, what position he has in the business you assume he is 'running'.

If they're running that business, they are either paying people who can tell them the dependencies (if not, those people are being paid too much), or they are responsible for the code themselves (small co. or early startup), and should already know, or with small effort be able to identify all the dependencies whenever necessary. Anything else would be irresponsible. If they're not running that business and have enou…

I currently am helping to run a kitchen at a restaurant in my spare time and I can tell you that nobody including myself can tell you where our onions are grown, but that they come from Costco

Re: Backyourstack: discover and sponsor your open-source dependencies

#35

Post by znarfor »

nickjj wrote: post #25

I tried putting in my github account on the home page just to see what would happen. I didn't create an account or sign in, but it created a public profile on your domain using my name without my consent. Is there any way to remove that?

In that case, it's just reading the public data from GitHub on demand, there is no account, nothing stored.

Re: Backyourstack: discover and sponsor your open-source dependencies

#36

Post by oliwarner »

dschep wrote: post #30
oliwarner wrote: post #20

> If you want to analyze non-public repositories, sign in with your GitHub account Do people really expose their or their employer's source code to random third party convenience services? I do understand the convenience factor here, I just think it's dodgy to encourage developers to be so flippant with privileged access.

It also has the option to upload a package.json which is far less exposure, and can easily be tweaked to omit anything sensitive.

It's still not no-exposure, and it's still getting a developer in the mindset that just sending out files on a whim is okay.

I'm not wholly against this sort of stuff, I'm sure we've used similar links in the past for CI and coverage, but it seems to be the end of the slope, where we're handing out access to our stuff for something so frivolous. This is the same sort of mechanism that got everybody and their dog's copies of Windows XP infected with trojans in the early 2000s. "Sure, I'll install that toolbar, just let me see Britney naked".

This could be a local, auditable script that fetched a static list of projects seeking funding.

Re: Backyourstack: discover and sponsor your open-source dependencies

#37

Post by thatjsguy »

oliwarner wrote: post #36
dschep wrote: post #30

Earlier quoted context omitted.

It also has the option to upload a package.json which is far less exposure, and can easily be tweaked to omit anything sensitive.

It's still not no-exposure, and it's still getting a developer in the mindset that just sending out files on a whim is okay. I'm not wholly against this sort of stuff, I'm sure we've used similar links in the past for CI and coverage, but it seems to be the end of the slope, where we're handing out access to our stuff for something so frivolous. This is the same sort of mechanism that got everybody and their dog's co…

To be fair, I don’t think this is intentionally bad privacy-wise. I think that, uh, a lot of the JavaScript set doesn’t actually know how to write code that doesn’t involve uploading shit to websites. When all you have is a hammer...

Re: Backyourstack: discover and sponsor your open-source dependencies

#38

Post by [deleted] »

anoncoward111 wrote: post #31
ajdlinux wrote: post #28

Earlier quoted context omitted.

Understandable that you're adding support for languages and packaging ecosystems as you go, and JS + PHP is as good a place as any to start, but it would be helpful if this were explicitly highlighted. For those who are unfamiliar with the ecosystems in question, package.json and composer.json are just filenames that don't actually tell you anything.

It would be helpful, and the site creator should list it. However, let's not treat this as a fault. They're offering you a free service and can't launch with every issue already resolved before being identified.

[deleted]

Re: Backyourstack: discover and sponsor your open-source dependencies

#39

Post by nickjj »

znarfor wrote: post #35
nickjj wrote: post #25

I tried putting in my github account on the home page just to see what would happen. I didn't create an account or sign in, but it created a public profile on your domain using my name without my consent. Is there any way to remove that?

In that case, it's just reading the public data from GitHub on demand, there is no account, nothing stored.

Ah ok, it looked like maybe it was created and cached and then publicly accessible at backyourstack.com/foo since that's the URL it forwards you to.

You might want to anonymize that URL for accounts who don't sign up just for clarity.

Post reply on HN