Post #2331127
2026-05-08 11:02 UTC
Replies (6)
-
@andrewnez@mastodon.social 2026-05-08 16:23
The code I used to collect and query this data from @ecosystems@mastodon.social is here: https://github.com/andrew/weekend-at-bernies
-
@mistersql@mastodon.social 2026-05-08 12:03
@andrewnez@mastodon.social I had a bot write skip-trace to try to track down who in the real world owns a package. A lot of the package repos - don't care who owns the package - want to protect privacy Is Mr Anonymous dead? How can you know anything about someone you know nothing about? #Pypi provides no messaging system itself. But does have a package takeover process that depends on messaging! https://pypi.org/project/skip-trace/
-
@djc@hachyderm.io 2026-05-08 14:30
@andrewnez@mastodon.social could I get access to the list of dead critical repos in the Cargo ecosystem (ideally in order of criticality)? Seems very relevant to my RustSec work.
-
@donaldball@triangletoot.party 2026-05-08 15:48
@andrewnez@mastodon.social @bagder@mastodon.social Maybe worth observing that there are mature language ecosystems (clojure, elixir) where folk are culturally quite careful about dependencies, and often times a package not being changed for years is a sign not of abandonment, but that the package is finished.
-
@aerique@genart.social 2026-05-08 16:02
@andrewnez@mastodon.social That's a nice conundrum: Declare a tight version range and get hit by vulnerabilities because new versions are not downloaded; Or accept (patch) updates and get hit because a vulnerable update is downloaded (f.e. due to a supply chain attack).
-
@PGBeattie@mastodonapp.uk 2026-05-08 16:09
@andrewnez@mastodon.social . I think the remake of Weekend at Bernie's... set at the White House .. Weekend at Donnie's is pushing credibility a bit... it's a bit of a caricature of reality.... some of the stunts are beyond belief