A deep dive into measuring dependency freshness with lib year
•
1 like•230 views
These are the slides for a talk that I gave at the Python Web Conference in June 2020.
Recommended
Recommended
More Related Content
What's hot
What's hot (17)
Similar to A deep dive into measuring dependency freshness with lib year
Similar to A deep dive into measuring dependency freshness with lib year (20)
Recently uploaded
Recently uploaded (20)
A deep dive into measuring dependency freshness with lib year
- 1. @mscottford MEASURING DEPENDENCY FRESHNESS BY M. SCOTT FORD CO-FOUNDER & CHIEF CODE WHISPERER, CORGIBYTES A DEEP DIVE INTO USING LIBYEAR
- 4. @mscottford HI. I LOVE TO FIX BUGS. I’M SCOTT.
- 7. @mscottford WHY DOES THIS HAPPEN? Photo credit: https://www.flickr.com/photos/mharrsch/402046838
- 8. @mscottford WHY DOES THIS HAPPEN? • Fear Photo credit: https://www.flickr.com/photos/mharrsch/402046838
- 9. @mscottford WHY DOES THIS HAPPEN? • Fear • Time Photo credit: https://www.flickr.com/photos/mharrsch/402046838
- 10. @mscottford WHY DOES THIS HAPPEN? • Fear • Time • Priorities Photo credit: https://www.flickr.com/photos/mharrsch/402046838
- 11. @mscottford WHY DOES THIS HAPPEN? • Fear • Time • Priorities • Perceived difficulty Photo credit: https://www.flickr.com/photos/mharrsch/402046838
- 12. @mscottford WHY DOES THIS HAPPEN? • Fear • Time • Priorities • Perceived difficulty • Invisible problem Photo credit: https://www.flickr.com/photos/mharrsch/402046838
- 13. @mscottford DEPENDENCY FRESHNESS Source: Measuring Dependency Freshness in Software Systems by J. Cox et al. (ICSE 2015), May 2015 https://ericbouwers.github.io/papers/icse15.pdf @mscottford
- 14. @mscottford IT’S LIKE BRUSHING YOUR TEETH @mscottford
- 16. @mscottford BRUSH YOUR TEETH Source: Measuring Dependency Freshness in Software Systems by J. Cox et al. (ICSE 2015), May 2015 https://ericbouwers.github.io/papers/icse15.pdf @mscottford OUT OF DATE DEPENDENCIES HAVE CONSEQUENCES @mscottford
- 18. @mscottford • Difficult to work with FOR DEVS @mscottford
- 19. @mscottford • Difficult to work with • Docs are hard to find FOR DEVS @mscottford
- 20. @mscottford • Difficult to work with • Docs are hard to find • Support is lacking FOR DEVS @mscottford
- 22. @mscottford FOR ORGS • Developer productivity
- 23. @mscottford FOR ORGS • Developer productivity • Significant security risks
- 24. @mscottford FOR ORGS • Developer productivity • Significant security risks • PR fallouts or loss of customer trust
- 28. @mscottford WHY LIBYEAR? • Easy to compute
- 29. @mscottford WHY LIBYEAR? • Easy to compute • Distills dependency risk as a single number
- 30. @mscottford WHY LIBYEAR? • Easy to compute • Distills dependency risk as a single number • Easy to communicate
- 31. @mscottford WHY LIBYEAR? • Easy to compute • Distills dependency risk as a single number • Easy to communicate • Provides even more value when graphed over time
- 33. @mscottford LATEST VERSION: RELEASE DATE CURRENT VERSION: RELEASE DATE – = PACKAGE LIBYEAR LIBYEAR: SINGLE PACKAGE @mscottford
- 34. @mscottford PACKAGE(0).LIBYEAR + PACKAGE(1).LIBYEAR + PACKAGE(N).LIBYEAR … = PROJECT LIBYEAR LIBYEAR: ENTIRE PROJECT @mscottford
- 38. @mscottford
- 39. @mscottford HOW TO MEASURE AUTOMATED – CHANGES OVER TIME
- 42. @mscottford
- 43. @mscottford
- 45. @mscottford
- 46. @mscottford
- 47. @mscottford FRESHLI’S FUTURE MISSION VISION Create tools that clearly illustrate the financial risk of deferred software maintenance. Software systems are self-healing and outdated dependencies are a thing of the past.
- 48. @mscottford BEST NEXT STEPS • Develop metric that considers security risk • Formulate ways to better compare LibYear across projects • Provide more guidance about “good” values (apps <= 10)
- 49. @mscottford GET INVOLVED • github.com/corgibytes/freshli • Add more metrics • Support more ecosystems and dependency formats • Improve graph quality
- 52. @mscottford CONTACT INFO M. SCOTT FORD scott@corgibytes.com @mscottford in/mscottford 804-596-2375 x701