I don't understand how gnucash is more critical than Arduino, wine or nginx. Is gnucash very widely used?
Finding Critical Open Source Projects
11–20 of 102 posts
Re: Finding Critical Open Source Projects
#12As others have mentioned, while this may seem like a good idea, the results are often bizarre, and it's not hard to see why - the metrics and algorithm are here: https://github.com/ossf/criticality_score#criticality-score . That algorithm seems unnecessarily complicated and includes somewhat dubious metrics when, in my mind, the only thing that really "counts" when it comes to "criticality" are "how many other things…
- Other metrics such as how many contributors and organizations are involved, how many user feature requests and bugs getting reported, those are all important project importance and not just "dependency count". some projects can be standalone, so as per your algo, those should be very low.
- Downloads data is not available for most repos, please find a reliable metric to use.
- Package repo dependencies works, but it does not work for C/C++. At some point, we will integrate github's dependency count info as well.
Re: Finding Critical Open Source Projects
#13Lots of things to check out here, and it's limited only to projects that are on github, but unsurprisingly it looks like the top 5 are: - Node (0.984) - Tensorflow (0.969) - Git (0.945) - Linux (0.936) - PHP (0.919)
Tensorflow ranking higher than Linux is a weird one. Tensorflow debuted to a huge amount of hype, but it could fall over and nearly all our software systems would be totally fine.
The rest in that list seem reasonable.
Re: Finding Critical Open Source Projects
#14Sounds interesting in theory, but the results are somewhat bizarre. For example, their published list of the top 200 "most critical" open-source C projects includes Urbit and Stellar, and includes micropython but does not include CPython.
As per Github (see languages section on bottom right), Cpython is 63% Python, and 29% C code, so its api returns Python as main language. cpython is in top 10 in python_top_200.csv
Re: Finding Critical Open Source Projects
#15I don't understand how gnucash is more critical than Arduino, wine or nginx. Is gnucash very widely used?
It does seem to be popular w.r.t user downloads and other github metrics.
E.g. https://sourceforge.net/projects/gnucash/files/stats/timelin...
Wikipedia - "As of July 2018, SourceForge shows a count of over 6.3 million downloads of the stable releases starting from November 1999[24] Also, Sourceforge shows that current downloads are running at ~7,000 per week.[25] This does not include other software download sites as well as Linux distributions that provide download from their own repositories."
Re: Finding Critical Open Source Projects
#16Neither the blog post nor project README directly mentions whether the 0.0 to 1.0 score goes from most-critical to least, or least-critical to more.
It appears 1.0 is most-critical, if you dig into ranking lists.
Re: Finding Critical Open Source Projects
#17Strange list, PMD so high, quarkus also, but e.g. jackson is lower then those both.
elasticsearch at the top? flink? It is first time I hear about it and I work in Java shops for quite some time.
Re: Finding Critical Open Source Projects
#18List of the top 200 is at : https://commondatastorage.googleapis.com/ossf-criticality-sc... (from the repo) So gnucash is #15 . At #75 is gcc . This seems like a great idea, but perhaps some refinements are needed.
World is not perfect. In case of gcc, it is only a mirror on github [https://github.com/gcc-mirror/gcc], so we dont get all the metrics, we do plan to improve this part [but this will be slow to clone repo, know their custom issue trackers, etc].
Gnucash is still a popular project, has like ~7k downloads a week, see wikipedia page.
Re: Finding Critical Open Source Projects
#19Neither the blog post nor project README directly mentions whether the 0.0 to 1.0 score goes from most-critical to least, or least-critical to more. It appears 1.0 is most-critical, if you dig into ranking lists.
Thanks, fixed in https://github.com/ossf/criticality_score/commit/fddcc093c7e...
Re: Finding Critical Open Source Projects
#20As others have mentioned, while this may seem like a good idea, the results are often bizarre, and it's not hard to see why - the metrics and algorithm are here: https://github.com/ossf/criticality_score#criticality-score . That algorithm seems unnecessarily complicated and includes somewhat dubious metrics when, in my mind, the only thing that really "counts" when it comes to "criticality" are "how many other things…
Github's downloads don't tell you when FAANG added your project to their internal project tree, which is then deployed in hundreds of millions of devices.