Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Finding Critical Open Source Projects

opensource.googleblog.com

Post reply on HN
Print view View original

31–40 of 102 posts

Re: Finding Critical Open Source Projects

#31

Post by detaro »

abharya wrote: post #12
hn_throwaway_99 wrote: post #10

As others have mentioned, while this may seem like a good idea, the results are often bizarre, and it's not hard to see why - the metrics and algorithm are here: https://github.com/ossf/criticality_score#criticality-score . That algorithm seems unnecessarily complicated and includes somewhat dubious metrics when, in my mind, the only thing that really "counts" when it comes to "criticality" are "how many other things…

- Other metrics such as how many contributors and organizations are involved, how many user feature requests and bugs getting reported, those are all important project importance and not just "dependency count". some projects can be standalone, so as per your algo, those should be very low. - Downloads data is not available for most repos, please find a reliable metric to use. - Package repo dependencies works, but i…

So basically the algorithm is designed to not find projects that are critical because they are deep in the foundations, depended on by nearly everyone but only worked on by a few people? (which is what "critical" would suggest at least to me) This seems to be mostly a "github marketing index"...

I seriously hope no actual decisions about resource allocation etc are made based on this.

Re: Finding Critical Open Source Projects

#32

Post by bzb6 »

abharya wrote: post #15
eh78ssxv2f wrote: post #11

I don't understand how gnucash is more critical than Arduino, wine or nginx. Is gnucash very widely used?

It does seem to be popular w.r.t user downloads and other github metrics. E.g. https://sourceforge.net/projects/gnucash/files/stats/timelin... Wikipedia - "As of July 2018, SourceForge shows a count of over 6.3 million downloads of the stable releases starting from November 1999[24] Also, Sourceforge shows that current downloads are running at ~7,000 per week.[25] This does not include other software download sites a…

7000 downloads per week is almost nothing.

Re: Finding Critical Open Source Projects

#33

Post by watwut »

krzyk wrote: post #17

Strange list, PMD so high, quarkus also, but e.g. jackson is lower then those both. elasticsearch at the top? flink? It is first time I hear about it and I work in Java shops for quite some time.

I mean, our company uses elasticsearch. But like, if it went away, it would not be critical or something. Some features would degrade a bit and no one would cared.

But yeah, the list is bizarre. It is more of "list of cool things to read about that you dont really need" then "critical list".

Re: Finding Critical Open Source Projects

#34

Post by orf »

abharya wrote: post #12
hn_throwaway_99 wrote: post #10

As others have mentioned, while this may seem like a good idea, the results are often bizarre, and it's not hard to see why - the metrics and algorithm are here: https://github.com/ossf/criticality_score#criticality-score . That algorithm seems unnecessarily complicated and includes somewhat dubious metrics when, in my mind, the only thing that really "counts" when it comes to "criticality" are "how many other things…

- Other metrics such as how many contributors and organizations are involved, how many user feature requests and bugs getting reported, those are all important project importance and not just "dependency count". some projects can be standalone, so as per your algo, those should be very low. - Downloads data is not available for most repos, please find a reliable metric to use. - Package repo dependencies works, but i…

You didn’t identify certifi, urllib3, chardet or pytz in your top 10 critical Python dependencies. These are all highly download packages, mostly maintained by one person, which are totally critical to millions of other packages and the Python ecosystem as a whole.

A few of your top-10 I can agree with, but when you’re saying a home-automation package (“core”) is more critical than something like pytz then something has gone terribly wrong.

Re: Finding Critical Open Source Projects

#35

Post by breakingcups »

abharya wrote: post #18
sien wrote: post #7

List of the top 200 is at : https://commondatastorage.googleapis.com/ossf-criticality-sc... (from the repo) So gnucash is #15 . At #75 is gcc . This seems like a great idea, but perhaps some refinements are needed.

World is not perfect. In case of gcc, it is only a mirror on github [ https://github.com/gcc-mirror/gcc ], so we dont get all the metrics, we do plan to improve this part [but this will be slow to clone repo, know their custom issue trackers, etc]. Gnucash is still a popular project, has like ~7k downloads a week, see wikipedia page.

Strangely enough that's not mentioned anywhere on the announcement. In fact, it seems to announce that very real funding decisions are going to be made based on this score already.

How can you make accurate decisions based on inaccurate data?

Which reminds me of that Babbage quote: "On two occasions I have been asked, 'Pray, Mr. Babbage, if you put into the machine wrong figures, will the right answers come out?' I am not able rightly to apprehend the kind of confusion of ideas that could provoke such a question."

Re: Finding Critical Open Source Projects

#36

Post by tziki »

EvilEy3 wrote: post #26
Buetol wrote: post #9

Top 10: - Python: salt, core ( https://github.com/home-assistant/core ), pandas, scikit-learn, numpy, airflow, erpnext, matplotlib, pytest & pip - Rust: servo, cargo, rust-clippy, tokio, rust-analyzer, tock, tikv, alacritty, libc & substrate - JS: node, react-native, react, gatsby, three.js, bootstrap, material-ui, odoo, next.js & Rocket.Chat - Java: elasticsearch, flink, spring-boot, hadoop, netty, jenkins, beam, ba…

In what universe Bazel is a critical project for Java ecosystem?

In the Android universe?

Re: Finding Critical Open Source Projects

#37

Post by TAForObvReasons »

Buetol wrote: post #9

Top 10: - Python: salt, core ( https://github.com/home-assistant/core ), pandas, scikit-learn, numpy, airflow, erpnext, matplotlib, pytest & pip - Rust: servo, cargo, rust-clippy, tokio, rust-analyzer, tock, tikv, alacritty, libc & substrate - JS: node, react-native, react, gatsby, three.js, bootstrap, material-ui, odoo, next.js & Rocket.Chat - Java: elasticsearch, flink, spring-boot, hadoop, netty, jenkins, beam, ba…

Some de-duplication is needed. 12, 13, and 14 for JS are amphtml

Re: Finding Critical Open Source Projects

#38

Post by bayindirh »

Buetol wrote: post #9

Top 10: - Python: salt, core ( https://github.com/home-assistant/core ), pandas, scikit-learn, numpy, airflow, erpnext, matplotlib, pytest & pip - Rust: servo, cargo, rust-clippy, tokio, rust-analyzer, tock, tikv, alacritty, libc & substrate - JS: node, react-native, react, gatsby, three.js, bootstrap, material-ui, odoo, next.js & Rocket.Chat - Java: elasticsearch, flink, spring-boot, hadoop, netty, jenkins, beam, ba…

C++: Eigen (the linear algebra and matrix library powering tensorflow and many more projects).

Re: Finding Critical Open Source Projects

#39

Post by Ensorceled »

eh78ssxv2f wrote: post #11

I don't understand how gnucash is more critical than Arduino, wine or nginx. Is gnucash very widely used?

Even if it is widely used, there are tons of replacements.

This ranking is very flawed if I can literally go to Best Buy and get a replacement for "critical" software.

Post reply on HN