Hacker News

points by ang_cire 14 hours ago | 0 comments

Beyond ongoing support, community/number of contributors doesn't indicate anything, though?

And maintainability is a function of code, as it relates to humans, so it is a measure of the code itself.

One of the things I've actually seen companies considering (due to supply chain compromise attacks), is not just having an in-house package repo that trails public versions, but instead fully in-housing critical dependencies and essentially making them private forks that they (probably use LLMs to) maintain.

Basically cutting out the Chainguard-like companies that made private deps their business model.

[–] xmprt 8 hours ago

You can argue that correlation doesn't imply causation, but typically more contributors means more people who have played a part in the code and so more eyes on the project to catch issues as well as a higher bus factor and less key person risk.

And larger community means there's more rewards for a successful attack and therefore fewer latent security issues (ie, obvious ones are more likely to be caught).

I think companies considering building in-house packages are just trading one risk for another. Especially with LLMs, it's going to be a lot easier to find vulnerabilities in your internal dependency than it would be in a battle hardened dependency used by 100s of others.