[Brian_K_White]

I don't recognize any such thing as a "dead open source project".

If one project is dead, what makes another one alive? Recent updates? It's working as intended and no updates needed or worth the effort. Even if "working as intended" only means it works on some old platform and no current one. Other users? Why do I or you or anyone care about that?

Other users only matters for commercial software where you are selling copies or expertise or your resume or something tied to it.

If someone writes something and publishes it, and not a single other person ever uses it, and the author never adds another update, that is still not "dead". It's just software that exists.

It's some kind of focus on a weird goal. If your purpose in writing open source was for it to be popular, then buy advertising until you force it to happen.

[mickael-kerjean]

Tell that to CVEs

[Brian_K_White]

Tell me how they matter.

They don't. If some code is so old or un-used that you would call it "dead" then there are no cve's on it. No one is using it to discover a vulerability, no one is studying it to find a vulnerability, who writes these supposed cves?

Even if by some miraculous combination of unlikely contrived coincidenses, someone researches, discoveres, writes up, and submits a cve, and the tracking orgs accept and publish it, so what? You just called it "dead" so who does it affect? What does this "cve" matter?

If they do matter because there are users, then it's not "dead".

It's just code that exists that may or may not be useful or interesting to someone sometime for something, or not, like a novel or song or painting.

If it's half-baked code with some problem if it were used exactly as it sits with no further work, so what?