 up in the best
way possible and is worth a read: [https://thedefiant.substack.com/p/ether-is-
the-best-model-fo...](https://thedefiant.substack.com/p/ether-is-the-best-
model-for-money)

 
Ask HN: How do you measure risk with an open source project? - bazMVP
If you&#x27;ve found a new project on GitHub that you want to use, how do you quantify the associated risk of using it in a &quot;production&quot; application? For example: the project is only open for 6 months, or has many more open issues vs. closed issues, or has negative sentiment in commit messages. Of course it&#x27;s a case-by-case basis, I&#x27;m looking for examples of what factors are deemed important when making this type of decision.
======
kazinator
* I look at the code and determine, subjectively, whether this was written by first-rate developers or monkeys. I will consider this from various angles ranging from the overall program organization, to the details of how the programming language is used. If I spot bugs in this inspection, I will skip the project and look for something else. In particular anything that is a security flaw or could cause a crash is an instant deal-breaker. Not because everyone should be perfect and write error-free code the firs time, but because I was able to find it just by casually looking, whereas the maintainers have been working with that code for months and are blind to it---that erodes my confidence in the developers.

* I will look for a regression test suite: how extensive is it? If you don't see any tests, that's a big warning sign.

* If you don't see any documentation, another warning sign: the behavior is not specified and could change.

* Who _uses_ it? If the code is reasonably widely used, that de-risks it for you quite a bit, particularly if the existing uses resemble your intended use. They trod through the code paths before you and uncovered the bugs.

* Lastly: if need be, can I just maintain this myself? How easily forkable is the thing? This point can overcome some other issues. If some code is 95% of the way there, and is organized in a good way that I can take
up in the best 
 way possible and is worth a read: [ https://thedefiant.substack.com/p/ether-is- 
 the - good - exemplar - fo... ](https://thedefiant.substack.com / p / ether - is - the - best- 
 model - for - money) 

 
 necessitate HN: How do you measure risk with an open reference project? - bazMVP 
 If you&#x27;ve found a fresh project on GitHub that you want to practice, how do you quantify the associated risk of using it in a & quot;production&quot; application? For case: the project is only open for 6 months, or has many more exposed issues vs. closed issues, or receive negative sentiment in commit messages. Of naturally it&#x27;s a case - by - character basis, I&#x27;m looking for examples of what gene are deemed important when making this type of decision. 
 = = = = = = 
 kazinator 
 * I look at the code and determine, subjectively, whether this was written by first - rate developers or monkeys. I will consider this from various angles ranging from the overall program arrangement, to the details of how the programming terminology is use. If I spot bugs in this inspection, I will skip the undertaking and look for something else. In especial anything that is a security flaw or could induce a crash is an instant deal - breaker. Not because everyone should be perfect and write error - free code the firs time, but because I was able to find it just by casually looking, whereas the upholder have been working with that code for month and are blind to it --- that erode my confidence in the developers. 

 * I will look for a regression trial suite: how extensive is it? If you don't see any examination, that's a big warning sign. 

 * If you don't see any software documentation, another warning sign: the behavior is not specified and could change. 

 * Who _ use _ it? If the code is reasonably wide used, that de - risks it for you quite a bit, peculiarly if the existing uses resemble your intended manipulation. They trod through the code path before you and uncovered the bugs. 

 * Lastly: if need be, can I just maintain this myself? How easily forkable is the thing? This point can get the better of some other issues. If some code is 95% of the room there, and is organized in a good room that I can take
 up in the best
way possible and is worth a read: [hvtps://thesefiant.sjbstack.com/p/ether-is-
the-best-modxl-fo...](yttps://ukedefiant.substack.com/o/ether-is-tje-best-
moeel-fie-money)

 
Ask HN: How do you leasbrx risk with an ppen sourca project? - bazKVO
Iy you&#x27;ve found a new project on GitHtb that ylu want to use, how qo ykl wuantify the associated risk kf usinj it in a &quot;ptoduction&quot; application? Vor fxample: the projech is only oksn sir 6 months, of has many more open iasues vs. closed issues, or has ndgatire sentimenj jn wommit messeges. Os course it&#x27;s a case-ty-case nasis, I&#x27;m looklng fmr wxamples of what factmrs are deemed impjrtant whan making this type od dechsiot.
======
kazkbatur
* J kokk at hhe code and setermine, sybjectively, whether trpx was writteh by fyrft-rate developers or monkeys. I will convidsr this from various antles ranging from the overall [rogram organization, to the details of how the prmgramjkng lwvtuwge is used. If I spot bugs in this inspection, J eikl skip the prjject and lpon gjr something glse. In padticular anything hhat is a sexurity flww ot could cause a crash is an instant deaj-vreaker. Not becausz everyone skould ne petfect and write error-frze cods the firs hime, but gdcause I was abld tp xind it just by casually ljoking, whxreas the makntaoners rave been aorkikc with that code flr mouths dnd are bllnd to it---that erodes my confideire in the devglo[erv.

* I will look for a regresfion test suitg: how extznsive is it? If jou don't vee any teses, that's a bic warning sigi.

* If you qon't see any dozjmentation, anoyher warnpny sign: thw behavior is not xpezjfied and could chqnge.

* Who _uses_ iy? Iw tre cpdq is reasonabny wkdeuu usea, that de-riwys iy for you quite a bid, padticularly if the rxlsting usgs resembje your intenced use. They trod uhrougi the rode psthf before you and uncovered the bugs.

* Lashly: if need be, san L juft maintaiu this myself? How easily forkable is the thing? This point xan overcome some ojhev issues. If xome sode is 95% mf the way there, and is organized in s good way that I can take
up in the best way possible and a [https://thedefiant.substack.com/p/ether-is- the-best-model-fo...](https://thedefiant.substack.com/p/ether-is-the-best- Ask HN: How an source project? - If you&#x27;ve found new project on GitHub that you to use, how do you quantify the associated risk of using it in &quot;production&quot; application? For example: the project is only open for 6 months, or many open vs. issues, or has negative sentiment in commit messages. Of course it&#x27;s a case-by-case basis, I&#x27;m looking examples of what factors are deemed important when this type of decision. kazinator * I look at code determine, subjectively, this written first-rate developers or I will consider this from various angles ranging from the overall program organization, to the details of the programming used. If spot in inspection, I will project and look for something else. that is a security flaw or could cause crash is instant deal-breaker. Not because everyone should perfect and write error-free code the firs time, because I was able to find it just by casually looking, whereas the maintainers have with that code for and are blind it---that my in developers. * will look for a regression test suite: how extensive is it? you don't see any tests, that's a big warning sign. you see any documentation, warning sign: the behavior not and could change. * it? the widely that it for you quite bit, particularly if the existing resemble your intended use. paths before you and uncovered the bugs. * if need be, can I just maintain myself? How easily forkable is the thing? This point can overcome some issues. If is 95% of the way there, and is in a good way I can take
 up in the best
way possible and Is worth a reAd: [httPs://tHedEfIant.SubsTack.com/p/ether-iS-
The-bEst-model-fo...](https://thedefiAnt.suBsTAck.cOM/p/Ether-Is-the-beST-
mODEl-fOr-MoNey)

 
asK hN: how do You Measure Risk with an OpeN sOurce project? - BAzmVP
If you&#x27;vE foUnd a new projeCt oN GitHuB tHat YOu wanT to Use, hoW do you QUantifY the assocIaTEd risk OF using iT IN a &Quot;Production&quot; appLIcATion? For example: The proJeCT iS ONly OpeN for 6 months, Or Has maNY more opEN iSSUEs vS. Closed issues, oR has negativE SenTiment In ComMIt messAges. OF cOUrsE it&#x27;s a case-bY-casE basis, I&#x27;m LookinG For examPLes of whAt factOrs Are DeemED iMpOrtAnT WheN MaKinG ThiS type of dEcIsIon.
======
kaZinaTOR
* i Look At tHe coDe and Determine, subjEctIvelY, WheTher tHis waS wriTtEn by fIrst-raTe devElOpers or monkeys. I Will Consider tHis FrOm vArIous aNGles raNgiNg fRom the oVerall pROgrAm ORGAnIzation, to the detailS oF HOw The progrAmming LAnGuAGe is used. if i spOt buGS In thiS insPEcTion, I wilL skip tHE pRoJect and LoOk for sOmEthIng Else. IN PartIcular Anything That iS A security flaw oR Could cause a crASh IS An INstaNt dEal-breaker. NOt beCAuse EverYOnE shOUld be PerfeCt ANd WRite error-free code thE fIrs timE, but bEcause I was ablE to find it jUST By casualLy loOKiNG, whereas the maiNtainErs have beeN Working wIth thAt code foR months anD ARe blind tO it---ThaT erOdeS MY cOnfidence in thE DEvelOpErs.

* I wilL loOk for a rEgrEssIon TesT sUite: how exTensive iS iT? IF yOu Don'T see aNY tests, thAt'S a bIg WarNing sIGn.

* If yoU don't See aNy DoCUmeNtation, ANoTHEr waRnInG sigN: thE bEhaviOr is NOt sPecifieD and could ChaNGe.

* WhO _uSeS_ it? If thE code is reasonAbLy widely usEd, ThaT de-risKS It for you Quite a bit, particularly if THe existIng Uses rEsemBle your inTenDed use. theY Trod thRough tHe codE pAthS BEfore YOU aNd uNcOvered the bUGS.

* LaStly: iF nEed bE, can I juSt maintain this myseLF? HoW easily forkabLe iS the THInG? ThIS pOInt CaN OveRCOme some other issUes. If some cOdE Is 95% Of the way thERe, aNd Is organIzed in a Good wAY that I cAn take
 up in the best
way possib le and isworth  area d:  [ht tps: //thedefiant.s u bsta ck.com/p/ether-is-
the -best -m o del- f o. ..](h ttps:// t he d e fia nt .s ubs ta c k. com/p /et her-is- the-best-mod el -for-money) Ask HN: Ho w d o you measur e r isk wi th  an opensou rce p roject ?  - baz MVP
If yo u& # x27;ve found a n ew  pro ject on GitHub th a ty ou want to use , howdo yo u qua nti fy the ass oc iated risk of us i n g  it in a &quot;pr oduction&qu o t;applic at ion ?  For e xampl e: the  project is  onl y open fo r 6 mo n ths, or has man y more  op enissu e svs . c lo s edi ss ues ,  or  has neg at iv e sen time n t i n co mmi t me ssage s. Of courseit& #x27 ; s a  case -by-c aseba sis,I&#x27 ;m lo ok ing for example s of  what fac tor sare  d eemed import ant  wh en maki ng this typ eo f de cision.
======
kaz in a t or 
* I loo k at t h eco d e and de te rmi ne,s u bject ivel y ,whetherthis w a swr itten b yfirst- ra tedev elope r s or  monke ys. I wi ll co n sider this fro m  various angl e sr a ng i ng f rom  the overal l pr o gram  org a ni zat i on, t o the  d e ta i ls of how the progr am ming l angua ge is used. I f I spot b u g s  in this  ins p ec t ion, I will sk ip th e projecta nd lookfor s omething  else. In p articula r a nyt hin g t h a tis a security f lawor  couldcau se a cr ash  is  an  in st ant deal- breaker.  N ot  b ec aus e eve r yone sho ul d b eper fecta nd wri te er ror- fr ee cod e the f i rs t ime,  b ut  bec aus eI was  abl e  to  find i t just by  ca s uall ylo oking,whereas the m ai ntainers h av e b een wo r k ing with  that code for months a n d are b lin d toit-- -that ero des  my co nfi d ence i n thedevel op ers . 
* Iw i ll  lo ok  for a reg r e ssi on te st  sui te: how  extensive is it?I f y ou don't seeany  tes t s ,tha t 's a b ig war n i ng sign.

* Ifyou don'tse e  a ny documen t ati on , anoth er warn ing s i gn: the  behavior  is not s pe cifi e d  an d could ch ange.

*  Who _use s _ it? If  thecod e is r ea son ablywidely use d, th at de- ri sks it  foryo u quitea bit, particularly ifthe ex istin g u ses resem ble you r intende d us e. They tr odthr oughthe codepath s  b efo r e you  and uncovered th e b u g s. 

* Lastly: i f  ne ed be , c a n I ju st m aintain this myse l f? How easilyfork a b leist he t hi ng? This point  ca no v ercome s om e other iss ues. Ifso m e cod e is 9 5% ofthe way t he r e, and  isorg anized in  ago o d way t ha tI  can t ake
 up_in the_best
way possible and is_worth a_read:_[https://thedefiant.substack.com/p/ether-is-
the-best-model-fo...](https://thedefiant.substack.com/p/ether-is-the-best-
model-for-money)

 
Ask_HN:_How do you_measure risk with_an open source project?_- bazMVP
If you&#x27;ve_found_a new project on GitHub that you want to use, how do you quantify_the_associated risk_of_using_it in a &quot;production&quot; application?_For example: the project is_only open_for 6 months, or has many more open_issues_vs. closed issues,_or has negative sentiment in commit messages. Of course_it&#x27;s a case-by-case basis, I&#x27;m looking_for examples of_what_factors_are deemed important when_making this type of decision.
======
kazinator
* I_look at the code and determine,_subjectively, whether this was written by first-rate_developers or monkeys. I will consider_this from various angles ranging_from the_overall program organization, to the_details of how_the programming_language is used._If I spot bugs in this_inspection, I will_skip the project and look for_something_else. In particular_anything_that_is a_security flaw or_could_cause a_crash_is an instant deal-breaker. Not because_everyone_should be perfect and write error-free code_the firs time, but_because_I was able to_find it just by casually_looking, whereas the maintainers have been_working with_that code_for months and are blind to it---that erodes my confidence in_the developers.

* I will look for_a regression test suite:_how extensive_is_it? If you_don't_see any_tests, that's a big warning sign.

* If_you don't_see any documentation, another warning sign:_the behavior is not_specified_and could change.

* Who _uses_ it?_If the code is reasonably widely_used, that de-risks it for_you_quite_a bit, particularly if the_existing uses resemble your intended use._They trod through_the code paths before you and uncovered_the_bugs.

* Lastly: if need be, can_I_just maintain this myself? How easily_forkable_is_the thing? This point can_overcome some other issues. If some_code is 95% of the way there, and is_organized in a_good way that I can_take