First of all, thx for documenting the mogration. That is very interesting.
Your monthly bill is smaller now. But how many hours did you invest into the migration? And how many hours more per month do you put in maintenance? I mean you have to take care of security patches now and many more things.
You used AWS in the most expensive way. Of course its expensive if you use on demand offering. You can cut costs by using Spot instances for ECS. Another way is by using reserved instances for ECS. If you pay 3 years upfront, you can get discounts up to 75%. That works for ECS and RDS.
I'm running ZEIT.IO on AWS and I had similar problems. But I don't want to manage VMs. As soon I have to SSH into something, I have a ton of problems I don't want to deal with.
Docker container pre-configured with Nginx as forwarding proxy. You can use it to either block all outgoing traffic and whitelist certain domains or allow all outgoing traffic and blacklist certain domains. Let me know if you find it useful!
That's nice to see the NSA is contributing to the OSS community. I just randomly picked one of the NSA GitHub repositories, analysed it with VersionEye (https://www.versioneye.com) and found already 25 security vulnerabilities. Who is the best person to contact in this case? Here is the security report: https://www.versioneye.com/user/projects/59479cd06725bd00123....
You could use the VersionEye Maven Plugin for that: https://github.com/versioneye/versioneye_maven_plugin. It checks your dependencies against a license whitelist on the VersionEye server and if there is a violation it breaks your build on your CI server. That way you can enforce a license policy continuously. It's much better than just checking licenses once a year ;-)
I'm working on VersionEye since a couple years, it's a similar project and I open sourced it last week: https://blog.versioneye.com/2016/06/28/versioneye-goes-open-.... I'm following Andrews activities since a while and like what he did with libraries.io. Great job! As both projects have a big overlap and are open source now I'm open for collaboration :)
I'm crawling some famous C repos at GitHub for VersionEye. There are listed here: https://www.versioneye.com/C. And I integrated the biicode, a dependency manager for C/C++. The biicode packages are listed here: https://www.versioneye.com/biicode. Currently there are no tags like at libraries.io but maybe I will add tags and tag filters for browsing tags/categories.
Everybody is an highly competitive field. Everybody wants to release as fast as possible. That's why everybody is using open source components. I know that everybody in the commercial field avoids GPL. Just curious which other licenses are on the blacklist of the some companies.
I wrote once a license crawler for VersionEye which recognises the most common licenses in README files on GitHub. But I didn't crawl whole GitHub! Only projects which are submitted in package managers and did not provide a license info on the package manager. I'm using it for example to complete license infos about RubyGem projects without a license on RubyGems.
Very interesting blog post. I wouldn't have thought that so less projects on GitHub provide a proper license! I'm working on https://www.versioneye.com and we track currently more than 500K open source projects in package managers. I just did a quick lookup in our database about Ruby licenses. Currently we have licenses for 56803 Ruby projects (RubyGems) and 49842 of them are MIT! That means 87% of all Ruby projects who provide a license at all, provide an MIT license! I will do a couple more queries and write a blog post to this!
Cool page. Makes totally sense. I'm doing it the same way. And in addition I use VersionEye to get notified about new versions of open source libraries I'm using in my projects. That saves me a lot of time. By the way I'm the dude who started VersionEye.
Check out jeweler (https://www.versioneye.com/ruby/jeweler/2.0.1). It makes creating and managing a Gem much easier ;-) Since I know it, it is a must have in all of my Gem projects.
Your last sentence is specially interesting. Being able to do a "bower install backbone" and going back to work is actually the purpose of a package manager. If it doesn't understand your project structure and is not able to wire the downloaded libraries into your project, whats the point of using it? Then bower is as good as npm or any other tool to download libraries. Right?
Your monthly bill is smaller now. But how many hours did you invest into the migration? And how many hours more per month do you put in maintenance? I mean you have to take care of security patches now and many more things.
You used AWS in the most expensive way. Of course its expensive if you use on demand offering. You can cut costs by using Spot instances for ECS. Another way is by using reserved instances for ECS. If you pay 3 years upfront, you can get discounts up to 75%. That works for ECS and RDS.
I'm running ZEIT.IO on AWS and I had similar problems. But I don't want to manage VMs. As soon I have to SSH into something, I have a ton of problems I don't want to deal with.