Finding Critical Open Source Projects • Hacker News Board

Re: Finding Critical Open Source Projects

#41

Post by leegraham » Fri, Dec 11, 2020, 11:25 AM UTC

EvilEy3 wrote: post #26

Buetol wrote: post #9

Top 10: - Python: salt, core ( https://github.com/home-assistant/core ), pandas, scikit-learn, numpy, airflow, erpnext, matplotlib, pytest & pip - Rust: servo, cargo, rust-clippy, tokio, rust-analyzer, tock, tikv, alacritty, libc & substrate - JS: node, react-native, react, gatsby, three.js, bootstrap, material-ui, odoo, next.js & Rocket.Chat - Java: elasticsearch, flink, spring-boot, hadoop, netty, jenkins, beam, ba…

In what universe Bazel is a critical project for Java ecosystem?

It looks like it's in the Java section because it's written _in_ Java, not because it's critical _to_ Java. Similarly, php-src isn't critical to C.

Re: Finding Critical Open Source Projects

#42

Post by ktpsns » Fri, Dec 11, 2020, 11:46 AM UTC

sien wrote: post #7

List of the top 200 is at : https://commondatastorage.googleapis.com/ossf-criticality-sc... (from the repo) So gnucash is #15 . At #75 is gcc . This seems like a great idea, but perhaps some refinements are needed.

Jup. Amongst the 200 "most critical python libriaries" are for instance https://github.com/plamere/spotipy, a client API for Spotify. I don't believe that the majority of Python codes want to play spotify streams :-)

Re: Finding Critical Open Source Projects

#43

Post by justinclift » Fri, Dec 11, 2020, 11:52 AM UTC

Buetol wrote: post #9

Top 10: - Python: salt, core ( https://github.com/home-assistant/core ), pandas, scikit-learn, numpy, airflow, erpnext, matplotlib, pytest & pip - Rust: servo, cargo, rust-clippy, tokio, rust-analyzer, tock, tikv, alacritty, libc & substrate - JS: node, react-native, react, gatsby, three.js, bootstrap, material-ui, odoo, next.js & Rocket.Chat - Java: elasticsearch, flink, spring-boot, hadoop, netty, jenkins, beam, ba…

Definitely needs more work.

The main Go SQLite3 for accessing SQLite databases is in the top "C" list.

But SQLite itself doesn't seem to be included in any of them. o_O

Re: Finding Critical Open Source Projects

#44

Post by nine_k » Fri, Dec 11, 2020, 12:26 PM UTC

Buetol wrote: post #9

Top 10: - Python: salt, core ( https://github.com/home-assistant/core ), pandas, scikit-learn, numpy, airflow, erpnext, matplotlib, pytest & pip - Rust: servo, cargo, rust-clippy, tokio, rust-analyzer, tock, tikv, alacritty, libc & substrate - JS: node, react-native, react, gatsby, three.js, bootstrap, material-ui, odoo, next.js & Rocket.Chat - Java: elasticsearch, flink, spring-boot, hadoop, netty, jenkins, beam, ba…

Interestingly missing from the list: LLVM, SQLite, Postgres.

Re: Finding Critical Open Source Projects

#45

Post by yorwba » Fri, Dec 11, 2020, 1:10 PM UTC

megous wrote: post #27

Buetol wrote: post #9

Top 10: - Python: salt, core ( https://github.com/home-assistant/core ), pandas, scikit-learn, numpy, airflow, erpnext, matplotlib, pytest & pip - Rust: servo, cargo, rust-clippy, tokio, rust-analyzer, tock, tikv, alacritty, libc & substrate - JS: node, react-native, react, gatsby, three.js, bootstrap, material-ui, odoo, next.js & Rocket.Chat - Java: elasticsearch, flink, spring-boot, hadoop, netty, jenkins, beam, ba…

Which of these match the image in the article, where some random Nebraskan is maintaining some obscure dependency?

The criteria https://github.com/ossf/criticality_score/blob/main/README.m... are designed to give higher scores to projects that are updated frequently by many contributors from different organizations, so of course the random Nebraskan's critical project is going to get a low "criticality score".

Re: Finding Critical Open Source Projects

#46

Post by jchw » Fri, Dec 11, 2020, 1:27 PM UTC

justinclift wrote: post #43

Buetol wrote: post #9

Top 10: - Python: salt, core ( https://github.com/home-assistant/core ), pandas, scikit-learn, numpy, airflow, erpnext, matplotlib, pytest & pip - Rust: servo, cargo, rust-clippy, tokio, rust-analyzer, tock, tikv, alacritty, libc & substrate - JS: node, react-native, react, gatsby, three.js, bootstrap, material-ui, odoo, next.js & Rocket.Chat - Java: elasticsearch, flink, spring-boot, hadoop, netty, jenkins, beam, ba…

Definitely needs more work. The main Go SQLite3 for accessing SQLite databases is in the top "C" list. But SQLite itself doesn't seem to be included in any of them. o_O

That might be because sqlite isn’t on Github.

Re: Finding Critical Open Source Projects

#47

Post by arp242 » Fri, Dec 11, 2020, 1:28 PM UTC

justinclift wrote: post #43

Buetol wrote: post #9

Top 10: - Python: salt, core ( https://github.com/home-assistant/core ), pandas, scikit-learn, numpy, airflow, erpnext, matplotlib, pytest & pip - Rust: servo, cargo, rust-clippy, tokio, rust-analyzer, tock, tikv, alacritty, libc & substrate - JS: node, react-native, react, gatsby, three.js, bootstrap, material-ui, odoo, next.js & Rocket.Chat - Java: elasticsearch, flink, spring-boot, hadoop, netty, jenkins, beam, ba…

Definitely needs more work. The main Go SQLite3 for accessing SQLite databases is in the top "C" list. But SQLite itself doesn't seem to be included in any of them. o_O

That's probably because SQLite doesn't use git, and this tool seems to require git. Actually, in its current state it seems to require GitHub: https://github.com/ossf/criticality_score/blob/main/critical...

This probably omits some other projects as well which don't use git or GitHub.

Re: Finding Critical Open Source Projects

#48

Post by defanor » Fri, Dec 11, 2020, 1:40 PM UTC

I like this idea, which pops up here and there occasionally, but this particular "criticality score" appears to measure popularity, rather than criticality. For one, it doesn't take into account whether there are common alternatives to a given project/package. Of course data like that is hard to gather automatically and from GitHub, but possibly that's just not a great source, and/or could be combined with others -- such as operating systems' repositories, which would contain information not just about alternatives, but also about packages required to run a minimal system, and to build it.

Re: Finding Critical Open Source Projects

#49

Post by eeZah7Ux » Fri, Dec 11, 2020, 1:53 PM UTC

Buetol wrote: post #9

Top 10: - Python: salt, core ( https://github.com/home-assistant/core ), pandas, scikit-learn, numpy, airflow, erpnext, matplotlib, pytest & pip - Rust: servo, cargo, rust-clippy, tokio, rust-analyzer, tock, tikv, alacritty, libc & substrate - JS: node, react-native, react, gatsby, three.js, bootstrap, material-ui, odoo, next.js & Rocket.Chat - Java: elasticsearch, flink, spring-boot, hadoop, netty, jenkins, beam, ba…

The results are really flawed.

Re: Finding Critical Open Source Projects

#50

Post by throwaway342422 » Fri, Dec 11, 2020, 2:00 PM UTC

hn_throwaway_99 wrote: post #10

As others have mentioned, while this may seem like a good idea, the results are often bizarre, and it's not hard to see why - the metrics and algorithm are here: https://github.com/ossf/criticality_score#criticality-score . That algorithm seems unnecessarily complicated and includes somewhat dubious metrics when, in my mind, the only thing that really "counts" when it comes to "criticality" are "how many other things…

The methodology is pretty silly. It rewards activity and popularity.

A lot of critical infrastructure software is not active and not often spoken about!

Case in point: The https://www.cip-project.org/faq project highlight the needs of very-long-term support for OS components that run on critical infrastructure such as power stations.

The https://www.cip-project.org/faq project is based on Debian. Very little of it is on github.