Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Finding Critical Open Source Projects

opensource.googleblog.com

Post reply on HN
Print view View original

21–30 of 102 posts

Re: Finding Critical Open Source Projects

#21

Post by eitland »

sien wrote: post #7

List of the top 200 is at : https://commondatastorage.googleapis.com/ossf-criticality-sc... (from the repo) So gnucash is #15 . At #75 is gcc . This seems like a great idea, but perhaps some refinements are needed.

Maven and Gradle both missing from top 20 on Java.

Whatever one thinks about Java development, if those two tools disappeared most Java development world wide would stop.

There would always be the lone developers deploying from IntelliJ/NetBeans/Eclipse and a few people using Ant/Bazel/Ivy but I must admit I haven't seen any of those "in the wild" the last three years.

Re: Finding Critical Open Source Projects

#22

Post by skinkestek »

sitzkrieg wrote: post #8
Svetlitski wrote: post #4

Sounds interesting in theory, but the results are somewhat bizarre. For example, their published list of the top 200 "most critical" open-source C projects includes Urbit and Stellar, and includes micropython but does not include CPython.

seems like completely arbitrary garbage

I.e. worse than ordinary search results?

Re: Finding Critical Open Source Projects

#23

Post by cryptica »

There are some issues with the criticality score (https://github.com/ossf/criticality_score).

For example, it counts the number of issues as determining criticality. If there is any kind of money attached to this score (now or in the future), obviously this is going to encourage people to introduce more bugs into their projects.

Re: Finding Critical Open Source Projects

#24

Post by schoen »

abharya wrote: post #15
eh78ssxv2f wrote: post #11

I don't understand how gnucash is more critical than Arduino, wine or nginx. Is gnucash very widely used?

It does seem to be popular w.r.t user downloads and other github metrics. E.g. https://sourceforge.net/projects/gnucash/files/stats/timelin... Wikipedia - "As of July 2018, SourceForge shows a count of over 6.3 million downloads of the stable releases starting from November 1999[24] Also, Sourceforge shows that current downloads are running at ~7,000 per week.[25] This does not include other software download sites a…

> This does not include other software download sites as well as Linux distributions that provide download from their own repositories.

Isn't that a pretty significant difficulty for the interpretation of this number, though? Couldn't there be some package that is installed by default in, say, Ubuntu (and that Ubuntu can't boot without), so therefore millions of users are using it -- but perhaps the "downloads" seen by GitHub or SourceForge are mostly by OS packagers or by developers contributing to that package. Whereas if there is something where, for some reason, end-users customarily or commonly get it from GitHub or Sourceforge, it might look more widely used even though it is actually less used overall, potentially even by orders of magnitude.

(Like GNU coreutils, at an extreme, is probably not that popular at all for end users to download from a source control system, yet it might be running in tens or hundreds of millions of devices, which could not even boot without it.)

Re: Finding Critical Open Source Projects

#25

Post by rwmj »

It's nice that they're automating this even though the results seem currently a bit random. Fedora has a concept of Critical Path packages (https://fedoraproject.org/wiki/Critical_path_package). The concept is related to various activities, eg. a package is critical if is is needed when installing a graphical desktop. But as far as I know packages are picked manually and therefore we probably miss packages or over/underestimate criticality.

Re: Finding Critical Open Source Projects

#26

Post by EvilEy3 »

Buetol wrote: post #9

Top 10: - Python: salt, core ( https://github.com/home-assistant/core ), pandas, scikit-learn, numpy, airflow, erpnext, matplotlib, pytest & pip - Rust: servo, cargo, rust-clippy, tokio, rust-analyzer, tock, tikv, alacritty, libc & substrate - JS: node, react-native, react, gatsby, three.js, bootstrap, material-ui, odoo, next.js & Rocket.Chat - Java: elasticsearch, flink, spring-boot, hadoop, netty, jenkins, beam, ba…

In what universe Bazel is a critical project for Java ecosystem?

Re: Finding Critical Open Source Projects

#27

Post by megous »

Buetol wrote: post #9

Top 10: - Python: salt, core ( https://github.com/home-assistant/core ), pandas, scikit-learn, numpy, airflow, erpnext, matplotlib, pytest & pip - Rust: servo, cargo, rust-clippy, tokio, rust-analyzer, tock, tikv, alacritty, libc & substrate - JS: node, react-native, react, gatsby, three.js, bootstrap, material-ui, odoo, next.js & Rocket.Chat - Java: elasticsearch, flink, spring-boot, hadoop, netty, jenkins, beam, ba…

Which of these match the image in the article, where some random Nebraskan is maintaining some obscure dependency?

Re: Finding Critical Open Source Projects

#28

Post by [deleted] »

abharya wrote: post #18
sien wrote: post #7

List of the top 200 is at : https://commondatastorage.googleapis.com/ossf-criticality-sc... (from the repo) So gnucash is #15 . At #75 is gcc . This seems like a great idea, but perhaps some refinements are needed.

World is not perfect. In case of gcc, it is only a mirror on github [ https://github.com/gcc-mirror/gcc ], so we dont get all the metrics, we do plan to improve this part [but this will be slow to clone repo, know their custom issue trackers, etc]. Gnucash is still a popular project, has like ~7k downloads a week, see wikipedia page.

[deleted]

Re: Finding Critical Open Source Projects

#29

Post by lokedhs »

EvilEy3 wrote: post #26
Buetol wrote: post #9

Top 10: - Python: salt, core ( https://github.com/home-assistant/core ), pandas, scikit-learn, numpy, airflow, erpnext, matplotlib, pytest & pip - Rust: servo, cargo, rust-clippy, tokio, rust-analyzer, tock, tikv, alacritty, libc & substrate - JS: node, react-native, react, gatsby, three.js, bootstrap, material-ui, odoo, next.js & Rocket.Chat - Java: elasticsearch, flink, spring-boot, hadoop, netty, jenkins, beam, ba…

In what universe Bazel is a critical project for Java ecosystem?

The Google universe. Don't they use it for all their builds?

Re: Finding Critical Open Source Projects

#30

Post by stonogo »

Buetol wrote: post #9

Top 10: - Python: salt, core ( https://github.com/home-assistant/core ), pandas, scikit-learn, numpy, airflow, erpnext, matplotlib, pytest & pip - Rust: servo, cargo, rust-clippy, tokio, rust-analyzer, tock, tikv, alacritty, libc & substrate - JS: node, react-native, react, gatsby, three.js, bootstrap, material-ui, odoo, next.js & Rocket.Chat - Java: elasticsearch, flink, spring-boot, hadoop, netty, jenkins, beam, ba…

I'm interested in the gulf between low-level systems code and effectively end-user code here. Things like GLib, Cairo, Harbuzz, etc -- none of the end-user tools work without them. It really demonstrates just how difficult this evaluation can be.
Post reply on HN