推文

So today the pi-coding-agent package is here for both the CLI usage and people to built on top. It's entirely unclear to me how we could properly pin it, particularly with shrinkwrap being deprecated now. What's the right move? Not to use npm install -g at all? I'm out of ideas.

Europeans please wake up.

I really believed a whole generation of developers, who only know open source from npm and pypi, miss how open source actually used to work. When Debian or a Linux distribution ships a dependency they take responsibility of it. If there is a security issue and it’s not fixed by the developer upstream, they fix it for their users. Debian and others basically vendor every thing they distribute. They honor the license and they maintain patches. Most of the stuff that you get from your Linux distribution is basically a (small) fork. The same is true for Apple, Microsoft and others. The open source software they ship, they carry that responsibility. That doesn’t mean that security fixes are not upstreamed, but Apple or Debian or anyone else won’t jump in Twitter to shame a developer into compliance with their ways. They are not dependent on the health of a packaging infrastructure. They own their software including all the things it depends on. I want that thinking back. Because it fundamentally makes people feel more responsibility and it shares the burden of issues. It also does not put so much focus and attention on the one overworked developer who just happened to have too much of the world depend on their library. Remember: they carry a responsibility they never signed up to and they never got compensated for.