Open Source

I am Amey Thakur, and I opened github.com/Amey-Thakur on 5 September 2019, then left it empty for 425 days. Today, on its seventh anniversary, I read every repository on it in one sitting, oldest first. Three things became impossible to miss: the work that reaches people is the work a stranger can run without asking me anything, the quiet years were not idle years, and public work decays silently unless somebody audits it on purpose. This is the full account, with the figures, and what I gave every repository before closing it.

OSV-Scanner reads the licence text of every package it scans, and it parsed that text with a recursive descent that had no depth limit. Roughly three megabytes of open brackets exhausted the goroutine stack. In Go a stack overflow is a fatal error rather than a panic, so recover cannot catch it and one malformed package ended the entire scan. This is the report, the forty lines that fixed it, and what contributing upstream to Google actually involved.