Viewing profile — abharya

There is no exclusive focus, we are just starting somewhere where we can see the various metrics. Plan is to expand to non-github projects and other places (like custom issue track…

Thanks for your feedback, we do want to fix this. And we do agree that there are several critical packages missing that don't use all metrics on github, plus non-github projects. C…

Thanks for feedback, adding it for analysis in https://github.com/ossf/criticality_score/issues/23

We are working on this problem, it is not simple. Identifying dependency trees reliably across languages is not straightforward [only nice for package manager ones]. Follow https:/…

filed https://github.com/ossf/criticality_score/issues/23

coreutils is in the top 200 list, c_top_200.csv:coreutils, https://github.com/coreutils/coreutils,C,90,0,240,5,2.2,50,1... There will always be edge cases and scenarios we are not …

It is definitely difficult especially with critical dependencies. We are looking for any criteria to identify these in automated fashion. Parallely, for ones we know about those ar…

That is a bug, will be fixed soon.

The issue with the mirror is we don't get the important stats to make decisions. E.g. number of contributors, issue changes due to custom issue tracker. We are still thinking on ho…

This is still an early project to start somewhere. We are working on this problem as well. Trying to identify dependency trees and which smaller projects are the most widely used (…

Filed https://github.com/ossf/criticality_score/issues/20 , we will fix this, have an idea on the issue.

We have to start somewhere. It is understandable that this is not complete, so welcome your ideas to discover such projects. Please think of any metrics/ways to find such projects.…

They are there: cplusplus_top_200.csv:llvm-project, https://github.com/llvm/llvm-project,C++,48,0,2573,5,652.3,2... c_top_200.csv:postgres, https://github.com/postgres/postgres,C,1…

The list captures projects written in the Java language, not for Java ecosystem. See why it is critical here - https://github.com/bazelbuild/bazel/wiki/Bazel-Users

Yes correct. Right now, we are query-ing projects hosted on Github, but will be expanding to our source control system in the near future.

That is not true, check out this as an example - https://groups.google.com/g/wg-securing-critical-projects/c/... . We are just trying to help, so please provide constructive feedba…

Thanks, fixed in https://github.com/ossf/criticality_score/commit/fddcc093c7e...

World is not perfect. In case of gcc, it is only a mirror on github [ https://github.com/gcc-mirror/gcc ], so we dont get all the metrics, we do plan to improve this part [but this…

It does seem to be popular w.r.t user downloads and other github metrics. E.g. https://sourceforge.net/projects/gnucash/files/stats/timelin... Wikipedia - "As of July 2018, SourceF…

As per Github (see languages section on bottom right), Cpython is 63% Python, and 29% C code, so its api returns Python as main language. cpython is in top 10 in python_top_200.csv…

- Other metrics such as how many contributors and organizations are involved, how many user feature requests and bugs getting reported, those are all important project importance a…

These are just some initial metrics we picked for v1. Please suggest more by filing by a github issue here - https://github.com/ossf/scorecard/issues Over time, we will add more re…

The goals are different. Our goal is to help both open source developer improve their project so that it is more secure for the community in the long term. It also gives the consum…

Yes, we will automate score capturing over all projects in real-time in the future. https://github.com/ossf/scorecard/issues/12 The work to capture current vuln state is tracked in…