This is a great tool, and going to keep tabs on it for future use. I appreciated the package.json upload for my private repos. Kudos to whoever built it!
Backyourstack: discover and sponsor your open-source dependencies
41–50 of 65 posts
Re: Backyourstack: discover and sponsor your open-source dependencies
#42The site offers to analyze your composer.json file, but doesn't seem to identify even popular libs like Monolog and Doctrine
Re: Backyourstack: discover and sponsor your open-source dependencies
#43The site offers to analyze your composer.json file, but doesn't seem to identify even popular libs like Monolog and Doctrine
Monolog and Doctrine should be properly detected. After that, we need to match detected dependencies with fundraising strategies (today Open Collective, in the future Patreon and others). Maybe this is why they're not appearing in the "Projects Requiring Funding" section. Feel free to submit an issue on GitHub and we can look at that in details.
Re: Backyourstack: discover and sponsor your open-source dependencies
#44Earlier quoted context omitted.
Consider how many layers of dependencies are in use today, and you have no idea who the commenter is, what position he has in the business you assume he is 'running'.
If they're running that business, they are either paying people who can tell them the dependencies (if not, those people are being paid too much), or they are responsible for the code themselves (small co. or early startup), and should already know, or with small effort be able to identify all the dependencies whenever necessary. Anything else would be irresponsible. If they're not running that business and have enou…
>And as for the "layers" argument - if there are too many layers of dependencies to keep track of, something is very, very wrong with the technology you are using. (And yes, I do consider modern web tech completely insane.)
So you were basically being glib about the salaries, since you know a lot of us are in that position? What do you suggest we do?
When I list the dependency tree of our project at work I get ~5500 unique packages (many are different versions of the same ones). Does the fact that I don't know them by heart mean that I'm being paid too much?
Re: Backyourstack: discover and sponsor your open-source dependencies
#45Interesting project, would be great if this supported more than just JS projects, I'd be very interested to see some of the dependencies that my current business relies upon.
Kevin from https://fossa.io/ here.
We have an open source project just for this: https://github.com/fossas/fossa-cli. It currently supports roughly 20+ build systems and languages, and pairs with our web service for license and vulnerability discovery.
Would love your feedback.
Re: Backyourstack: discover and sponsor your open-source dependencies
#46Earlier quoted context omitted.
If they're running that business, they are either paying people who can tell them the dependencies (if not, those people are being paid too much), or they are responsible for the code themselves (small co. or early startup), and should already know, or with small effort be able to identify all the dependencies whenever necessary. Anything else would be irresponsible. If they're not running that business and have enou…
>And as for the "layers" argument - if there are too many layers of dependencies to keep track of, something is very, very wrong with the technology you are using. (And yes, I do consider modern web tech completely insane.) So you were basically being glib about the salaries, since you know a lot of us are in that position? What do you suggest we do? When I list the dependency tree of our project at work I get ~5500…
No, if anything, I think anyone working in your field is not being paid enough for working with something as bonkers crazy. :)
But seriously, I haven't said that you have to be able to recite the dependencies when woken up at night, just that you should have an existing internal methods of keeping track of them and auditing them, and not relying on some comes-one-day-disappears-the-next web service.
Re: Backyourstack: discover and sponsor your open-source dependencies
#47Earlier quoted context omitted.
If they're running that business, they are either paying people who can tell them the dependencies (if not, those people are being paid too much), or they are responsible for the code themselves (small co. or early startup), and should already know, or with small effort be able to identify all the dependencies whenever necessary. Anything else would be irresponsible. If they're not running that business and have enou…
I currently am helping to run a kitchen at a restaurant in my spare time and I can tell you that nobody including myself can tell you where our onions are grown, but that they come from Costco
There are grocery stores which specialize in being able to tell the customer exactly where their produce comes from. They've been quite in vogue these past years. :)
Re: Backyourstack: discover and sponsor your open-source dependencies
#48Earlier quoted context omitted.
Which technology are you using that does not have this problem?
I work on the opposite end from the web stack - firmware development - and even we have layers upon layers of dependencies that are problematic to track.
The point is not that the deps are problematic to track - that is to be expected with any larger project. The point is actually doing the tracking, and being aware when the deps change, new one gets added, etc., and being able to determine what it means for the business.
Re: Backyourstack: discover and sponsor your open-source dependencies
#49Earlier quoted context omitted.
I currently am helping to run a kitchen at a restaurant in my spare time and I can tell you that nobody including myself can tell you where our onions are grown, but that they come from Costco
There are grocery stores which specialize in being able to tell the customer exactly where their produce comes from. They've been quite in vogue these past years. :)
Interestingly enough, it's debatable how useful this info is, sort of like how it's debatable knowing every single dependency for your project :)
Re: Backyourstack: discover and sponsor your open-source dependencies
#50« 56 repositories depending on 0 Open Source projects. »
Well, that's not true. Maybe you could indicate which package systems you actually are able to analyze?