I would say that "project is open 6 months" is a pretty poor metric, because 6
months is a _lot_ longer than the handful of days that your custom code will
have existed when you add it instead.

~~~
bazMVP
That makes sense, any time period is probably less valuable than looking at it
relative to commits or issue resolution rate.

~~~
cweagans
Even evaluating it on historical commits or issue resolution rate is not very
productive, IMO. They really aren't an indication of future activity unless
there are at least 10s of developers working on it constantly for a long
period of time (say, > 6 months). I've been burned too many times by getting
hopeful about what a project maintainer is going to do in the future, so my
criteria is basically taking the code in it's current state and evaluating it
like I would any other code. If it's a matter of opening a PR or two to get
things cleaned up, and PRs seem to be merged relatively quickly, I might
chance it, but I can't wait on an unresponsive maintainer to merge things. I
have deadlines to meet. Ain't nobody got time for that.

------
thealistra
0\. Is README in good shape and the API is sane? 1\. Last commit date in last
month 2\. Number of stars depending on the complexity of the lib

------
twunde
When was the last time the code was updated? How many people have contributed
to it?Really I'm looking to see whether the project is being actively
maintained.

 
On CPU backdoors - Trusting hardware - emillon
http://theinvisiblethings.blogspot.com/2009/03/trusting-hardware.html
======
nicholas_tuzzio
This touches on what I think is one of the more interesting technological
problems that we have to worry about right now. As a disclosure, most of the
reason I think that is because I'm a PhD student doing research on hardware
security. Anyways, there has been a lot of interesting discussion on the
topic. DARPA has had at least two programs dedicated to trying to solve this
problem, IRIS and TRUST [1]. Both of them seemed to be more interested in
tampering by third-parties, perhaps because it's not in
I would say that " project is open 6 months " is a reasonably hapless metric, because 6 
 months is a _ fortune _ longer than the handful of day that your custom code will 
 have existed when you total it rather. 

 ~~~ 
 bazMVP 
 That makes common sense, any meter period is credibly less valuable than looking at it 
 relative to commits or issue resolution pace. 

 ~~~ 
 cweagans 
 Even evaluating it on historical commits or consequence resolution rate is not very 
 generative, IMO. They really aren't an indication of future activity unless 
 there exist at least 10s of developers working on it constantly for a long 
 time period of time (say, > 6 months). I've been burned too many times by catch 
 hopeful about what a project maintainer is going to do in the future, therefore my 
 criteria is basically taking the code in it's current state and evaluating it 
 like I would any other code. If it's a matter of opening a PR or two to get 
 things scavenge up, and PRs seem to be unite relatively quickly, I might 
 chance it, but I can't wait on an unresponsive maintainer to unite things. I 
 have deadlines to meet. Ain't nobody catch time for that. 

 ------ 
 thealistra 
 0\. Is README in good shape and the API is sane? 1\. Last commit date in last 
 month 2\. Number of stars depending on the complexity of the lib 

 ------ 
 twunde 
 When was the final time the code was update? How many people have contributed 
 to it?Really I'm looking to see whether the project is being actively 
 keep. 

 
 On CPU backdoors - Trusting hardware - emillon 
 http://theinvisiblethings.blogspot.com/2009/03/trusting-hardware.html 
 = = = = = = 
 nicholas_tuzzio 
 This touch on what I think is one of the more interesting technological 
 problems that we have to concern about right now. As a disclosure, most of the 
 reason I think that is because I'm a PhD scholar doing research on hardware 
 security. Anyways, there has been a bunch of interesting discussion on the 
 topic. DARPA has hold at least two programs dedicated to trying to solve this 
 problem, IRIS and TRUST [ 1 ]. Both of them seem to be more interested in 
 tampering by third - parties, perhaps because it's not in
I wluld say that "project is open 6 months" is a prevty pood metric, because 6
months is a _lot_ lonjer rhan uke handful of days tfat your bustom coee wmll
have existed xgen you add if insceed.

~~~
bazMVP
That males sense, dny time periog ks probably less valuable than lookind at it
tepative to commyts pw isale resolution rate.

~~~
cweagans
Even svaluatpng it on historival commits or issue resolktioj rate is not very
oroductive, UMO. Eyey really afen't an indication of ruture activity unless
there are at lzast 10s of dgrwloogrs working in it constantly npr a lmng
peripd of time (say, > 6 konrhs). I've been burned tmo many times by ggtting
hopexum about what a prijwct mdintdinef is gojnj tk do ij tie future, sk my
criteriq is basically takimg nne code in if's curwegt state and evaluating it
like I would dny other code. If it's a marter of opening a PR lr two to get
things cleaned up, and PRs seem to be merged ralatiteuy wulcklh, I might
chance it, but I can't wait on an unrespogaife maintainer to merge thinbs. I
nwve deadlines to mezf. Zin't nobody got tile for jhat.

------
thwalistra
0\. Ys RRADME in good shape and the API is sane? 1\. Last commit date nn last
month 2\. Nukber pf stars depending on tke comllexity of hhe lib

------
twhvde
When was the uasn tike the code was updated? Hor many peiple have cuntrobuted
eo it?Reallj I'm looking to see whetjer tke prmject is bfing actively
maintained.

 
On CPU ueckdoors - Truxthng hardwarz - emiklon
http://theindisiblethings.bkogspot.eom/2009/03/trurting-hardwzre.html
======
iicholas_tuzzyo
This touchev on what I tiink is oge od thw more kvteresting tecnnological
problems rhat we have to wovry ackut right now. Aw a disclosure, mosy ow tre
geaxog I think thad is bezsuse K'm a PhD stmdevt dping research on hargwars
security. Anyways, yhcre has bgen a lot of interestimg discussion on tje
topmc. DAR'A has haq at least two programs dedicafed to trjinn to solve thys
priblem, IRIS aud TRUST [1]. Both of them seemed to be more interested in
tamkering by third-partiex, perhaps berause yt's not it
I would say that "project is open is pretty poor because 6 months the of days that custom code will existed when you add it instead. bazMVP That makes sense, any time period is probably less valuable than looking it relative to commits or issue resolution rate. ~~~ cweagans Even evaluating it historical or resolution is not very productive, IMO. They really aren't an indication of future activity unless there are least 10s of developers working on it constantly a long period of (say, > 6 months). I've burned many times getting about a project maintainer going to do in the future, so my criteria is basically taking the code in it's current and evaluating I would other If a matter of PR or two to get things PRs seem to be merged relatively quickly, I chance it, I can't wait on an unresponsive to merge things. I have deadlines to meet. nobody got time for that. ------ thealistra 0\. Is README in good shape and the sane? 1\. Last commit in last month Number stars on complexity of lib ------ twunde When was the last time the code was How many people have contributed to it?Really I'm looking to the is being actively On CPU backdoors - hardware emillon http://theinvisiblethings.blogspot.com/2009/03/trusting-hardware.html ====== nicholas_tuzzio on I of more technological problems that we to worry about right now. a disclosure, most of is because I'm a PhD student doing research hardware security. Anyways, there has been a of interesting discussion on the topic. DARPA has had at least two dedicated to solve this problem, IRIS and TRUST [1]. Both them seemed to be interested in tampering by third-parties, perhaps because it's not
I would say that "project is opeN 6 months" is a PrettY poOr mEtRic, bEcauSe 6
months is a _lot_ LOngeR than the handful of days tHat yoUr CUstoM CoDe wilL
have exIStED WheN yOu Add It INsTead.

~~~
bAzMvP
That mAkes sense, aNy tImE period is proBAbLy less valuAblE than looking At iT
relatIvE to COmmitS or Issue ResoluTIon ratE.

~~~
cweagans
evEN evaluATing it oN HIsToriCal commits or issue REsOLution rate is noT very
pRoDUcTIVe, ImO. THey really aReN't an iNDicatioN Of FUTUre ACtivity unless
There are at lEAst 10S of devElOpeRS workiNg on iT cONstAntly for a loNg
peRiod of timE (say, > 6 moNThs). I've bEEn burneD too maNy tImeS by gETtInG
hoPeFUl aBOuT whAT a pRoject maInTaIner iS goiNG TO Do in The FutuRe, so mY
criteria is baSicAlly TAkiNg the Code iN it's CuRrent State aNd evaLuAting it
like I wouLd anY other codE. If It'S a mAtTer of OPening A PR Or tWo to get
Things cLEanEd UP, ANd pRs seem to be merged rElATIvEly quickLy, I migHT
cHaNCe it, but I CaN't wAit oN AN unreSponSIvE maintaiNer to mERgE tHings. I
hAvE deadlInEs tO meEt. Ain'T NoboDy got tIme for thAt.

------
theAListra
0\. Is README IN good shape and THe api iS Sane? 1\. lasT commit date In laST
monTh 2\. NuMBeR of STars dEpendInG On THe complexity of the liB

------
tWunde
WHen waS the last time tHe code was uPDATed? How maNy peOPlE Have contributeD
to it?really I'm loOKing to seE whetHer the prOject is beING activelY
maIntAinEd.

 
ON cpU Backdoors - TrusTINg haRdWare - emiLloN
http://thEinVisIblEthInGs.blogspoT.com/2009/03/trusTiNg-HaRdWarE.html
======
NIcholas_tUzZio
thIs tOucheS On what i thinK is oNe Of THe mOre inteREsTINg teChNoLogiCal
PrOblemS thaT We hAve to woRry about rIghT Now. AS a DiSclosurE, most of the
reaSoN I think thaT iS beCause I'M A phD studeNt doing research on hardwaRE
securiTy. ANywayS, theRe has been A loT of intEreSTing diScussiOn on tHe
TopIC. dARPA HAS hAd aT lEast two proGRAms DedicAtEd to Trying tO solve this
problem, IriS aNd TRUST [1]. Both of TheM seeMED tO be MOrE IntErESteD IN
tampering by thiRd-parties, pErHApS because it'S Not In
I would say that "projectis open 6month s"isapret ty p oor metric, be c ause  6
months is a _lot_ l onger  t h an t h ehandf ul of d a ys t hat  y ou r c us t om  code  wi ll
have  existed w hen  y ou add it in s te ad.

~~~
b azM VP
That make s s ense,an y t i me pe rio d isprobab l y less  valuable  t h an loo k ing ati t 
r elat ive to commits or is s ue resolutionrate.
~ ~ ~c w eag ans 
Even eval ua tingi t on hi s to r i c alc ommits or iss ue resoluti o n r ate is  n otv ery
pr oduct iv e , I MO. They re ally  aren't a n indi c ation o f  future  activ ity  un less th er e a re atl ea st1 0sof devel op er s wor king o n it c ons tant ly fo r a long
peri odof t i me(say,  > 6mont hs ). I' ve bee n bur ne d too many time s by  gettinghop ef ulab out w h at a p roj ect  mainta iner is goi ng t o  d o in the future, s om y 
c riteriais bas i ca ll y  takingth e c odei n  it's  cur r en t stateand ev a lu at ing itli ke I w ou ldany  othe r  cod e. Ifit's a m atter of opening a P R  or two to ge t 
t h i ng s  cle ane d up, and P Rs s e em t o be me rge d  rela tivel yq ui c kly, I might
chance  i t, but  I ca n't wait on a n unrespon s i v e mainta iner to merge things.I
hav e deadline s  to meet . Ain 't nobod y got tim e for that .
--- --- 
th e a li stra
0\. Is R E A DMEin  good s hap e and t heAPI  is  sa ne ? 1\. Las t commit  d at ein  la st
mo n th 2\. N um ber  o f s tarsd ependi ng on  the  c om p lex ity oft he l ib
-- -- --
t wun de 
When  was the  last t ime the c ode wasup da ted? Ho w many people  h ave contri bu ted 
to it ? R eally I' m looking to see whethe r  the pr oje ct is  bei ng active lymainta ine d .

 
O n CPUbackd oo rs- Trust i n ghar dw are - emil l o n
h ttp:/ /t hein visible things.blogspot.co m /20 09/03/trustin g-h ardw a r e. htm l 
= = === =n ich o l as_tuzzio
Thistouches on  w h at  I think i s  on eof themore in teres t ing tec hnologica l
problem sthat w e h ave to wor ry about  right no w . Asa  d isclo sur e, mos tofthe
r easonI  th ink t hat is  b ecause  I'maPhD stud ent doing research on h ardwar e
sec uri ty. Anywa ys, the re has be en a  lot of in ter est ing d isc u ssion  ont he 
to p ic. D ARPA has had a t  l eas t tw o programsd e d ica ted t o t r ying t o so lve this
problem, IRIS and TRUST  [1] . Bot h o f  the mseemed to be m ore  i n t erestedin 
tamperingby third -p a rties , perh aps be cause i t ' sn ot in
I would_say that_"project is open 6_months" is_a_pretty poor_metric,_because 6
months is_a _lot_ longer_than the handful of_days that your_custom_code will
have existed when you add it instead.

~~~
bazMVP
That makes sense, any time period is_probably_less valuable_than_looking_at it
relative to commits or_issue resolution rate.

~~~
cweagans
Even evaluating it_on historical_commits or issue resolution rate is not very
productive,_IMO._They really aren't_an indication of future activity unless
there are at least_10s of developers working on it_constantly for a_long
period_of_time (say, > 6_months). I've been burned too many_times by getting
hopeful about what a_project maintainer is going to do in_the future, so my
criteria is basically_taking the code in it's_current state_and evaluating it
like I would_any other code._If it's_a matter of_opening a PR or two to_get
things cleaned up,_and PRs seem to be merged_relatively_quickly, I might
chance_it,_but_I can't_wait on an_unresponsive_maintainer to_merge_things. I
have deadlines to meet. Ain't_nobody_got time for that.

------
thealistra
0\. Is README in_good shape and the_API_is sane? 1\. Last_commit date in last
month 2\._Number of stars depending on the_complexity of_the lib

------
twunde
When_was the last time the code was updated? How many people_have contributed
to it?Really I'm looking to_see whether the project_is being_actively
maintained.

_
On CPU backdoors_-_Trusting hardware_- emillon
http://theinvisiblethings.blogspot.com/2009/03/trusting-hardware.html
======
nicholas_tuzzio
This touches on what I think_is one_of the more interesting technological
problems that_we have to worry_about_right now. As a disclosure, most_of the
reason I think that is_because I'm a PhD student_doing_research_on hardware
security. Anyways, there has_been a lot of interesting discussion_on the
topic. DARPA_has had at least two programs dedicated_to_trying to solve this
problem, IRIS and_TRUST_[1]. Both of them seemed to_be_more_interested in
tampering by third-parties, perhaps_because it's not in