SECURITY Signal 410
Who Should Pay For Source Code Availability?
↗
Loris Cro argues that the software industry must address the cost of reliable source code availability rather than relying on free hosting, comparing forking and vendoring as partial solutions.
Relying on centralized, free hosting platforms creates fragile dependency chains that break when those platforms experience downtime or degrade. Engineers need to understand the trade-offs between forking, vendoring, and centralized package indices to ensure build stability, as no current solution perfectly balances cost and discoverability.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
Forking and vendoring dependencies can prevent build failures from host downtime, but each has trade-offs regarding upstream contributions and discoverability.
Zig's recent caching changes make vendoring trivial by allowing developers to check a local package directory into source control.
The industry's reliance on free hosting from big tech companies is unsustainable, and self-hosting shifts the entire cost burden onto creators.
THE READ
What the cluster adds up to.
The core issue is the fragility of dependency chains tied to external hosting platforms. When services like GitHub or Codeberg experience downtime, builds fail because the source code is unavailable. This exposes a systemic problem: the industry has relied on free hosting, but this model is degrading, forcing a conversation about who should bear the cost of reliable availability.
Two primary mitigation strategies exist: forking and vendoring. Forking moves all dependencies to the project's host, requiring modification of indirect dependencies to point to new forks. Vendoring commits all dependency source code directly into the repository, which is straightforward for users of the Zig toolchain due to recent caching changes that store extracted files in a local directory.
Each strategy has distinct costs and limitations. Forking is preferable if you plan to modify dependencies and upstream changes, as cherry-picking commits is easier. Vendoring, while simpler for ensuring everything is available upon clone, makes it difficult for external package managers to discover or use the mirrored code automatically. Neither solution efficiently shares the cost of availability while maintaining broad usability.
Centralized package indices like npmjs.com or crates.io avoid these issues by essentially forking code into their own copies. However, this ties the solution of source availability to package management, leaving code fetched outside of a package manager vulnerable. The fundamental question remains how to distribute the cost of hosting between creators and consumers without relying on unsustainable free services or inefficient manual duplication.
Written by elseif from the cluster below · checked for specifics the sources never containedTHE CLUSTER