Jumping Rivers (@jumpingrivers.com)

R package validation is not always straightforward. Security, licensing, maintenance, and test coverage can point in different directions. Litmus and diffify help teams make clearer choices. For a simple overview, watch Colin Gillespie’s posit::conf 2025 talk: @posit.co

loading . . .

Can I trust that package? (Colin S Gillespie, Jumping Rivers) | posit::conf(2025) Can I trust that package? 💬 Speaker(s): Colin S Gillespie 📝 Abstract: We often forget, surrounded by hex stickers and bad R package puns, that not everyone is as trustworthy as us. This, I suppose, means that when IT asks, “Is this package valid, secure, and trustworthy?” it’s not that unreasonable a question. But this throws up multiple issues. There are thousands of R packages on CRAN, and that doesn’t include the R-universe, Bioconductor, and GitHub. Packages are updated all the time, so how do we keep up? More to the point what does valid, secure and trustworthy even mean? In this talk, I’ll discuss the litmusverse. A suite of packages for assessing a package risk. Importantly, it’s not one size fits all. Instead, it’s about defining your risk appetite and acting accordingly. posit::conf(2025) Subscribe to posit::conf updates: https://posit.co/about/subscription-management/ https://youtu.be/g6QU16jOt0g?si=0FwsRJ7qqYCQ4HPr