Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Backyourstack: discover and sponsor your open-source dependencies

backyourstack.com

Post reply on HN
Print view View original

51–60 of 65 posts

Re: Backyourstack: discover and sponsor your open-source dependencies

#51

Post by tajen »

JanisL wrote: post #2

Interesting project, would be great if this supported more than just JS projects, I'd be very interested to see some of the dependencies that my current business relies upon.

There’s a bit of irony in doing a crawler to give a few dollars to a JS library, when a lot of us run Linux (either on desktop or server) of abolutely immense value. What would one do without SSH? without Apache? without V8? without the Linux core? without Git? It’s great to fund the libraries, but don’t forget your OS, IDE, compiler, runtime etc.

Re: Backyourstack: discover and sponsor your open-source dependencies

#52

Post by znarfor »

phyzome wrote: post #50

« 56 repositories depending on 0 Open Source projects. » Well, that's not true. Maybe you could indicate which package systems you actually are able to analyze?

You're right, it's a common feedback we have, we even have an issue opened for that https://github.com/opencollective/backyourstack/issues/57 We explain what we support in the FAQ but that's not enough. What languages / packages managers are you expecting?

Re: Backyourstack: discover and sponsor your open-source dependencies

#53

Post by mbesto »

XiZhao wrote: post #45
JanisL wrote: post #2

Interesting project, would be great if this supported more than just JS projects, I'd be very interested to see some of the dependencies that my current business relies upon.

Kevin from https://fossa.io/ here. We have an open source project just for this: https://github.com/fossas/fossa-cli . It currently supports roughly 20+ build systems and languages, and pairs with our web service for license and vulnerability discovery. Would love your feedback.

Wait, can you do this as a one-time event without a paid subscription to your service?

Re: Backyourstack: discover and sponsor your open-source dependencies

#54

Post by justicz »

ariehkovler wrote: post #12
JanisL wrote: post #2

Interesting project, would be great if this supported more than just JS projects, I'd be very interested to see some of the dependencies that my current business relies upon.

I'm working with a pre-launch company that's building a tool to map companies' stacks (among other things). They've shared some of their research with me from and it's insane . Large software companies have no idea what dependencies, libraries, or even languages are in their stacks. Companies are using multiple versions of the same library, replicated in a bunch of different repos. Different teams in he same company…

It’s even more wild when you consider that these companies are relying on all of these dependencies to be secure, and to lack intentional backdoors.

Re: Backyourstack: discover and sponsor your open-source dependencies

#55

Post by phyzome »

znarfor wrote: post #52
phyzome wrote: post #50

« 56 repositories depending on 0 Open Source projects. » Well, that's not true. Maybe you could indicate which package systems you actually are able to analyze?

You're right, it's a common feedback we have, we even have an issue opened for that https://github.com/opencollective/backyourstack/issues/57 We explain what we support in the FAQ but that's not enough. What languages / packages managers are you expecting?

Common ones, I suppose! I have projects involving Java, Python, and Clojure. Of those, I would expect the first two to be covered by a generic dependency analyzer.

(It's fine if it doesn't, but it would be nice to know up front.)

Re: Backyourstack: discover and sponsor your open-source dependencies

#56

Post by hnruss »

Great idea! It's nice to see an easy way to support open-source software.

Regarding funding open-source software: Companies I've worked for have all been OK with purchasing licenses for software that saves development time. They've also been careful to abide by software license terms. I'm surprised that more open-source libraries/frameworks don't require the purchase of a commercial license in order to use them commercially.

Re: Backyourstack: discover and sponsor your open-source dependencies

#57

Post by remram »

XiZhao wrote: post #45
JanisL wrote: post #2

Interesting project, would be great if this supported more than just JS projects, I'd be very interested to see some of the dependencies that my current business relies upon.

Kevin from https://fossa.io/ here. We have an open source project just for this: https://github.com/fossas/fossa-cli . It currently supports roughly 20+ build systems and languages, and pairs with our web service for license and vulnerability discovery. Would love your feedback.

You claim this is open-source, however I don't see an easy way to run this myself without relying on your infrastructure and signup up for an account there. Your "analyse locally" option requires an API key and is therefore very much misnamed.

Re: Backyourstack: discover and sponsor your open-source dependencies

#58

Post by ajdlinux »

anoncoward111 wrote: post #31
ajdlinux wrote: post #28

Earlier quoted context omitted.

Understandable that you're adding support for languages and packaging ecosystems as you go, and JS + PHP is as good a place as any to start, but it would be helpful if this were explicitly highlighted. For those who are unfamiliar with the ecosystems in question, package.json and composer.json are just filenames that don't actually tell you anything.

It would be helpful, and the site creator should list it. However, let's not treat this as a fault. They're offering you a free service and can't launch with every issue already resolved before being identified.

Re-reading my comment I can see it reads a bit like that - I totally don't intend any notion that I expect everything to be perfect, I'm an open source developer myself and as you say we don't expect every issue to be resolved instantly!

Re: Backyourstack: discover and sponsor your open-source dependencies

#59

Post by anoncoward111 »

ajdlinux wrote: post #58
anoncoward111 wrote: post #31

Earlier quoted context omitted.

It would be helpful, and the site creator should list it. However, let's not treat this as a fault. They're offering you a free service and can't launch with every issue already resolved before being identified.

Re-reading my comment I can see it reads a bit like that - I totally don't intend any notion that I expect everything to be perfect, I'm an open source developer myself and as you say we don't expect every issue to be resolved instantly!

I was probably overly harsh and judgmental in my comment towards you. Glad we are in agreement!!!

Re: Backyourstack: discover and sponsor your open-source dependencies

#60

Post by Vinnl »

pferde wrote: post #48
ajdlinux wrote: post #29

Earlier quoted context omitted.

I work on the opposite end from the web stack - firmware development - and even we have layers upon layers of dependencies that are problematic to track.

The point is not that the deps are problematic to track - that is to be expected with any larger project. The point is actually doing the tracking, and being aware when the deps change, new one gets added, etc., and being able to determine what it means for the business.

So what technology are you using that makes that viable?
Post reply on HN