That's wonderful to read, that it caught and motivated you.
I suspect these systematic issues are much worse in bigger organizations. Smaller ones can be victims, try to pump out, or not care about quality too, but on smaller teams and hierarchies, you have much more impact. I suspect the chances of finding a good environment are higher in smaller companies. It worked for me, at least. Maybe I was just super lucky.
A library with no code, no support, no implementation, no guarantees, no bugs are "fixable" without unknown side effects, no fix is deterministic even for your own target language, …
A spec may be language agnostic, but the language model depends on trained on implementations. So, do you end up with standard library implementations being duplicated, just possibly outdated with open bugs and holes and gaps and old constructs? And quality and coverage of spec implementation will vary a lot depending on your target language? And if there's not enough conforming training it may not even follow the spec correctly? And then you change the spec for one niche language?
If it's a spect or LLM template, then that's what it is. Don't call it library. In the project readme don't delay until the last third to actually say what it is or does.
The only way out of this is regulation, which requires political activism.
The EU did some good process on that through GDPR and the newer digital laws regarding safety, disclosure, maintenance, and due diligence requirements. Prosecution with fines is there, but slow, and arguably too sporadic.
Political activism in this direction is unthankful work and a lot of effort. I am reminded of someone who has pushed for public institutions to move away from US big tech for many years. Now Trump is the reason for change, and their effort can surely feel pointless.
I do occasionally report GDPR violations, etc. That can feel pointless as well. But it's necessary, and the only way to (support/influence) agencies to take action.
The update system hoster determined the compromise was only used against specific targets, so it's relatively unlikely "normal people" would have been compromised. But if you want to check, you can check on those indicators. These only cover what was discovered on identified compromise, though.
Did trust signals change? Part of my reviews has always been checking assumptions and broader (project) context. I don't think polish implied understanding.
they asked me if I could develop some useful metrics for technical debt which could be surveyed relatively easily, ideally automatically
This is where I would have said “no, that's not possible” or had a discussion about risks where things you simply can't cover with automated metrics would lead to misdirection and possibly negative instead of positive consequences.
They then explore what technical debt is and notice that even many things outside of technical debt have significant impact you can't ignore. I'm quite disappointed they don't come back to their metrics task at all. How did they finish their task? Did they communicate and discuss all these broader concepts instead of implementing metrics?
There's some metrics you can implement on code. Test coverage, complexity by various metrics, function body length, etc. But they only ever cover small aspects of technical debt. Consequently, they can't be a foundation for (continuously) steering debt payment efforts for most positive effects.
I know my projects and can make a list of things and efforts and impacts and we can prioritize those. But I find the idea of (automated) metrics entirely inappropriate for observing or steering technical debt.
As a lead dev I have plenty of cases where I weigh effort vs impact and risk and conclude to "this is good enough for now". Such cases are not poor management - which I assume you mean something like "we have to ship more faster, so do the shortest". Sometimes cutting corners is the correct and good decision, sometimes the only feasible one, as long as you're aware and weigh risks and consequences.
We, and specifically I, do plenty of improvements where possible and reasonable. Whatever I visit, depending on how much effort it is. But sometimes effort is too much to be resolvable or investable.
For context, I'm working on a project that has been running for 20 years.
And apparently, it happened selectively, not generally, but for specific people/request sources.
It would only be if you use the Notepad++'s own update mechanism. If you used other package managers or went and downloaded the installer to update you'd be fine.
Our recognition of Greg honors his leading work on the Linux kernel and in the Linux community, particularly through his work on the stable branch of Linux. Greg serves as the stable kernel maintainer for Linux, a role of extraordinary importance to the entire computing world.
I would say doneness is about completeness within context, not immutability.
The environment may change, but within context, it can still be considered done.
It's fine to say and consider software never done, because there are known and unknown unknowns and extrapolations and expectations. But I think calling something done has value too.
It is a label of intention, of consideration, within the current context. If the environment changes and you want or need to use it, by all means update it. That doesn't mean the done label assigned previously was wrong [in its context].
We also say "I'm done" to mean our own leave, even when there is no completeness on the product, but only on our own tolerance.
In the same way, if you shift focus, done may very well be done and not done at the same time. Done for someone in one environment, and not done for someone in another.
More often than 'done' I see 'feature complete' or 'in maintenance mode' in project READMEs, which I think are better labels.
[…] Novice workers who rely heavily on AI to complete unfamiliar tasks may compromise their own skill acquisition in the process. We conduct randomized experiments to study how developers gained mastery of a new asynchronous programming library with and without the assistance of AI.
We find that AI use impairs conceptual understanding, code reading, and debugging abilities, without delivering significant efficiency gains on average. Participants who fully delegated coding tasks showed some productivity improvements, but at the cost of learning the library.
We identify six distinct AI interaction patterns, three of which involve cognitive engagement and preserve learning outcomes even when participants receive AI assistance. Our findings suggest that AI-enhanced productivity is not a shortcut to competence and AI assistance should be carefully adopted into workflows to preserve skill formation – particularly in safety-critical domains.
In my main work projects I regularly archive tags into refs/archive/tags/* - which is hidden from normal tooling, but still accessible in Git and (some?) Git tooling and UIs.
Branches get "path" prefixes like draft/* or other longterm category indications. I don't archive them, but if I would, I would put them into non /refs/heads like /refs/archive/heads/*.
What's Codeberg's stance on this? Do they advocate for this, accept it, or dislike it?
Their FAQ talks about having disabled mirroring because of resource use of abandoned mirrored repos. Their blog post about the drop of mirroring says that manual mirroring is still possible.
That's wonderful to read, that it caught and motivated you.
I suspect these systematic issues are much worse in bigger organizations. Smaller ones can be victims, try to pump out, or not care about quality too, but on smaller teams and hierarchies, you have much more impact. I suspect the chances of finding a good environment are higher in smaller companies. It worked for me, at least. Maybe I was just super lucky.