These are the slides for a talk that I gave at the Python Web Conference in June 2020.

1. @mscottford
MEASURING DEPENDENCY FRESHNESS
BY M. SCOTT FORD
CO-FOUNDER & CHIEF CODE WHISPERER, CORGIBYTES
A DEEP DIVE INTO
USING LIBYEAR

2. @mscottford
HI.

3. @mscottford
HI.
I’M SCOTT.

4. @mscottford
HI.
I LOVE TO FIX BUGS.
I’M SCOTT.

5. @mscottford
AND
DEPENDENCIES.
UPGRADE

6. @mscottford
Source: https://arstechnica.com/information-technology/2017/09/massive-equifax-breach-caused-by-failure-to-patch-two-month-old-bug/

7. @mscottford
WHY DOES THIS HAPPEN?
Photo credit: https://www.flickr.com/photos/mharrsch/402046838

8. @mscottford
WHY DOES THIS HAPPEN?
• Fear
Photo credit: https://www.flickr.com/photos/mharrsch/402046838

9. @mscottford
WHY DOES THIS HAPPEN?
• Fear
• Time
Photo credit: https://www.flickr.com/photos/mharrsch/402046838

10. @mscottford
WHY DOES THIS HAPPEN?
• Fear
• Time
• Priorities
Photo credit: https://www.flickr.com/photos/mharrsch/402046838

11. @mscottford
WHY DOES THIS HAPPEN?
• Fear
• Time
• Priorities
• Perceived difficulty
Photo credit: https://www.flickr.com/photos/mharrsch/402046838

12. @mscottford
WHY DOES THIS HAPPEN?
• Fear
• Time
• Priorities
• Perceived difficulty
• Invisible problem
Photo credit: https://www.flickr.com/photos/mharrsch/402046838

13. @mscottford
DEPENDENCY
FRESHNESS
Source: Measuring Dependency Freshness in Software Systems by J. Cox et al. (ICSE 2015), May 2015 https://ericbouwers.github.io/papers/icse15.pdf @mscottford

14. @mscottford
IT’S LIKE
BRUSHING
YOUR TEETH @mscottford

15. @mscottford
MINTY FRESH
SOFTWARE
@mscottford

16. @mscottford
BRUSH
YOUR TEETH
Source: Measuring Dependency Freshness in Software Systems by J. Cox et al. (ICSE 2015), May 2015 https://ericbouwers.github.io/papers/icse15.pdf @mscottford
OUT OF DATE DEPENDENCIES
HAVE CONSEQUENCES @mscottford

17. @mscottford
FOR DEVS
@mscottford

18. @mscottford
• Difficult to work with
FOR DEVS
@mscottford

19. @mscottford
• Difficult to work with
• Docs are hard to find
FOR DEVS
@mscottford

20. @mscottford
• Difficult to work with
• Docs are hard to find
• Support is lacking
FOR DEVS
@mscottford

21. @mscottford
FOR ORGS

22. @mscottford
FOR ORGS
• Developer productivity

23. @mscottford
FOR ORGS
• Developer productivity
• Significant security
risks

24. @mscottford
FOR ORGS
• Developer productivity
• Significant security
risks
• PR fallouts or loss of
customer trust

25. @mscottford
LIBYEAR
Source: https://libyear.com/

26. @mscottfordSource: https://libyear.com/ @mscottford

27. @mscottford
WHY LIBYEAR?

28. @mscottford
WHY LIBYEAR?
• Easy to compute

29. @mscottford
WHY LIBYEAR?
• Easy to compute
• Distills dependency risk as a
single number

30. @mscottford
WHY LIBYEAR?
• Easy to compute
• Distills dependency risk as a
single number
• Easy to communicate

31. @mscottford
WHY LIBYEAR?
• Easy to compute
• Distills dependency risk as a
single number
• Easy to communicate
• Provides even more value when
graphed over time

32. @mscottford
HOW TO MEASURE
MANUALLY

33. @mscottford
LATEST VERSION: RELEASE DATE
CURRENT VERSION: RELEASE DATE
–
=
PACKAGE LIBYEAR
LIBYEAR: SINGLE PACKAGE
@mscottford

34. @mscottford
PACKAGE(0).LIBYEAR +
PACKAGE(1).LIBYEAR +
PACKAGE(N).LIBYEAR
…
=
PROJECT LIBYEAR
LIBYEAR: ENTIRE PROJECT
@mscottford

35. @mscottford
HOW TO MEASURE
AUTOMATED

36. @mscottford
Source: https://github.com/nasirhjafri/libyear

37. @mscottford
EXAMPLE
PYSPIDER

38. @mscottford

39. @mscottford
HOW TO MEASURE
AUTOMATED – CHANGES OVER TIME

40. @mscottford
Source: https://github.com/corgibytes/freshli

41. @mscottford
EXAMPLE
PYSPIDER

42. @mscottford

43. @mscottford

44. @mscottford
EXAMPLE
FEEDBIN

45. @mscottford

46. @mscottford

47. @mscottford
FRESHLI’S FUTURE
MISSION VISION
Create tools that clearly illustrate
the financial risk of
deferred software maintenance.
Software systems are self-healing
and outdated dependencies
are a thing of the past.

48. @mscottford
BEST NEXT STEPS
• Develop metric that considers
security risk
• Formulate ways to better
compare LibYear across projects
• Provide more guidance about
“good” values (apps <= 10)

49. @mscottford
GET INVOLVED
• github.com/corgibytes/freshli
• Add more metrics
• Support more ecosystems and
dependency formats
• Improve graph quality

50. @mscottford
DEPENDENCIES
AUTO-UPGRADING
IS ACHIEVABLE

51. @mscottford
THANK YOU!

52. @mscottford
CONTACT INFO
M. SCOTT FORD
scott@corgibytes.com
@mscottford
in/mscottford
804-596-2375 x701