Finding Critical Open Source Projects
opensource.googleblog.com
Finding Critical Open Source Projects
1–10 of 102 posts
Re: Finding Critical Open Source Projects
#2Very interesting and I hope this leads to actual recompense/compensation for people "thanklessly maintaining" OSS. Not sure how it possibly fits into Google's newfound profit-at-all-costs motive, but the gesture is an important first step towards some semblance of justice.
Re: Finding Critical Open Source Projects
#3Very interesting and I hope this leads to actual recompense/compensation for people "thanklessly maintaining" OSS. Not sure how it possibly fits into Google's newfound profit-at-all-costs motive, but the gesture is an important first step towards some semblance of justice.
Can you elaborate more on the claimed "profit-at-all-costs" statement? It's been established that the purpose of most corporations are for profit, but iirc most large enterprises have a rather robust ethics framework when working with the OSS community.
Re: Finding Critical Open Source Projects
#4Sounds interesting in theory, but the results are somewhat bizarre. For example, their published list of the top 200 "most critical" open-source C projects includes Urbit and Stellar, and includes micropython but does not include CPython.
Re: Finding Critical Open Source Projects
#5Seems like a good direction. My main hope is that if metrics like these become more accepted and/or important, that they find a way to avoid running afoul of Goodhart's law.
Re: Finding Critical Open Source Projects
#6Lots of things to check out here, and it's limited only to projects that are on github, but unsurprisingly it looks like the top 5 are:
- Node (0.984)
- Tensorflow (0.969)
- Git (0.945)
- Linux (0.936)
- PHP (0.919)
Re: Finding Critical Open Source Projects
#7List of the top 200 is at :
https://commondatastorage.googleapis.com/ossf-criticality-sc...
(from the repo)
So gnucash is #15 . At #75 is gcc .
This seems like a great idea, but perhaps some refinements are needed.
Re: Finding Critical Open Source Projects
#8Sounds interesting in theory, but the results are somewhat bizarre. For example, their published list of the top 200 "most critical" open-source C projects includes Urbit and Stellar, and includes micropython but does not include CPython.
seems like completely arbitrary garbage
Re: Finding Critical Open Source Projects
#9Top 10:
- Python: salt, core (https://github.com/home-assistant/core), pandas, scikit-learn, numpy, airflow, erpnext, matplotlib, pytest & pip
- Rust: servo, cargo, rust-clippy, tokio, rust-analyzer, tock, tikv, alacritty, libc & substrate
- JS: node, react-native, react, gatsby, three.js, bootstrap, material-ui, odoo, next.js & Rocket.Chat
- Java: elasticsearch, flink, spring-boot, hadoop, netty, jenkins, beam, bazel, alluxio & pmd
- C++: tensorflow, ceph, pytorch, bitcoin, electron, Marlin, Cataclysm-DDA, llvm-project, rocksdb & QGIS
- C: git, linux, linux, php-src, openssl, systemd, curl, u-boot, qemu & mbed-os
Re: Finding Critical Open Source Projects
#10As others have mentioned, while this may seem like a good idea, the results are often bizarre, and it's not hard to see why - the metrics and algorithm are here: https://github.com/ossf/criticality_score#criticality-score.
That algorithm seems unnecessarily complicated and includes somewhat dubious metrics when, in my mind, the only thing that really "counts" when it comes to "criticality" are "how many other things use/depend on me", and there are much easier ways to determine this:
1. For languages with a common package repo, how many other packages depend on me? With NPM, for example, it's pretty easy to figure out how many other packages depend on a given package.
2. For "top level" projects, look at downloads.
My guess is just looking at either (or both) of those metrics would give you better results.