The open-source software repository is vast, but most projects fail early on. Before incorporating a tool into your workflow, take ten minutes to answer the following five questions.
1. How long ago was the most recent commit?
A project that has been silent for two years isn't necessarily dead—it may have been completed. But if the repository still has hundreds of open issues and no one is responding, that's a sign it's been abandoned.
2. How many people actually contribute?
A one-person project is the biggest risk in open source. If that person changes jobs, loses interest, or is simply too busy—the project grinds to a halt. Take a look at the contributor list: if 95% of the commits come from a single account, be prepared to maintain the project yourself.
3. Is the license suitable for your purposes?
- MIT, BSD, Apache — feel free to use them even in proprietary products
- GPL — if you distribute a product that contains it, the product must also be open-source
- AGPL — stricter; running it on a server that serves others is also considered distribution
For personal use, there’s virtually no difference. For business use, this is a mandatory question.
4. Can your data be retrieved?
This is the most important question that few people ask. Does the software store data in an open format or in a proprietary database? Does it have an export function? If you wanted to leave tomorrow, what could you take with you?
5. How did the community react to the security vulnerability?
Check the history of security patches. Serious projects have their own bug-reporting processes and release patches within a few days. In loosely managed projects, vulnerabilities are listed in monthly public issue reports.
A practical rule: the more important data you include, the more rigorous you must be with the first four sentences.
Thảo luận