> We all opted for centralized package repos though, so now only they know. And they’re not telling us.
I'm sympathetic to the view, but there really are some things that are better centralizing. Reducing code into binaries is something that a "fair" 3rd party is going to be better at than the 1st party. Why? The 3rd party central source is (presumably) mechanically cloning and building, whereas the 1st party is doing much much more. Effectively the 3rd party offers a better guarantee to the end user that this binary corresponds to that particular source.
Also, the Way to measure who's using your code is to put runtime telemetry in there. Distasteful, but so common now with every kind of software, it's crazy. Yes, even OSS CLI programs phone home now (heck, ohmyzsh phones home every time I open a terminal!). For a generic server library, you'd add a check to make sure it's the most recent version and print that out to stdout on startup.
See, it's not user hostile it's to keep them informed of updates! /s
I'm sympathetic to the view, but there really are some things that are better centralizing. Reducing code into binaries is something that a "fair" 3rd party is going to be better at than the 1st party. Why? The 3rd party central source is (presumably) mechanically cloning and building, whereas the 1st party is doing much much more. Effectively the 3rd party offers a better guarantee to the end user that this binary corresponds to that particular source.
Also, the Way to measure who's using your code is to put runtime telemetry in there. Distasteful, but so common now with every kind of software, it's crazy. Yes, even OSS CLI programs phone home now (heck, ohmyzsh phones home every time I open a terminal!). For a generic server library, you'd add a check to make sure it's the most recent version and print that out to stdout on startup.
See, it's not user hostile it's to keep them informed of updates! /s