Live data from Hacker News

Finding Critical Open Source Projects

opensource.googleblog.com

51–60 of 102 posts

Re: Finding Critical Open Source Projects

#51

As others have mentioned, while this may seem like a good idea, the results are often bizarre, and it's not hard to see why - the metrics and algorithm are here: https://github.com/ossf/criticality_score#criticality-score . That algorithm seems unnecessarily complicated and includes somewhat dubious metrics when, in my mind, the only thing that really "counts" when it comes to "criticality" are "how many other things…

Github's downloads don't tell you when FAANG added your project to their internal project tree, which is then deployed in hundreds of millions of devices.

...not to mention all the critical software running on power plants, industry, aircrafts, ships, cars, satellites, core Internet routing...

Did i forget military, e.g. weapons?

Re: Finding Critical Open Source Projects

#52
post #45
post #27

Earlier quoted context omitted.

Which of these match the image in the article, where some random Nebraskan is maintaining some obscure dependency?

The criteria https://github.com/ossf/criticality_score/blob/main/README.m... are designed to give higher scores to projects that are updated frequently by many contributors from different organizations, so of course the random Nebraskan's critical project is going to get a low "criticality score".

> of course the random Nebraskan's critical project is going to get a low "criticality score"

...which is the exact opposite of what it should be.

Re: Finding Critical Open Source Projects

#53
post #18
post #7

List of the top 200 is at : https://commondatastorage.googleapis.com/ossf-criticality-sc... (from the repo) So gnucash is #15 . At #75 is gcc . This seems like a great idea, but perhaps some refinements are needed.

World is not perfect. In case of gcc, it is only a mirror on github [ https://github.com/gcc-mirror/gcc ], so we dont get all the metrics, we do plan to improve this part [but this will be slow to clone repo, know their custom issue trackers, etc]. Gnucash is still a popular project, has like ~7k downloads a week, see wikipedia page.

> Gnucash is still a popular project, has like ~7k downloads a week, see wikipedia page.

omg they're actually doubling down on this. Libreoffice has something like 50k downloads per day and isn't listed, while among "critical projects" there is... minetest ? tesseract ? battle for wesnoth ? dolphin ? citra ?

There's qt creator (and a ton of Qt-using projects) but not Qt ?

Re: Finding Critical Open Source Projects

#56

As others have mentioned, while this may seem like a good idea, the results are often bizarre, and it's not hard to see why - the metrics and algorithm are here: https://github.com/ossf/criticality_score#criticality-score . That algorithm seems unnecessarily complicated and includes somewhat dubious metrics when, in my mind, the only thing that really "counts" when it comes to "criticality" are "how many other things…

One cool feature of functional package managers such as Nix and Guix is that the dependency graphs are entirely transparent and can be inspected programmatically.

I wrote a script that lists the number of dependents for each package in Guix by traversing the package graphs:

https://gist.github.com/mbakke/f354272666fbef09c5229f7b85377...

Running it takes about 16 seconds on my laptop, and piping to 'grep -v bootstrap | sort -rn | tail -n 20' gives:

  16695 guile
  16692 ld-wrapper
  14686 pkg-config
  14512 perl
  14444 ncurses
  13135 readline
  13133 zlib
  13022 libffi
  12470 xz
  12448 libunistring
  12433 openssl
  12353 bash
  12050 libxml2
  12016 gettext-minimal
  11950 tar
  11942 bzip2
  11896 expat
  11857 tzdata
  11850 net-base
  11846 python-minimal
(GCC, glibc and binutils are missing for complicated reasons, but should be up there with Guile)

By changing (all-packages) on line 26 to:

  (fold-packages (lambda (package result)
                   (if (string-prefix? "python-" (package-name package))
                       (cons package result)
                       result))
                 '()))
We get the most popular Python projects:

  6672 python-setuptools-scm
  6667 python-nose
  6662 python-pyparsing
  6662 python-more-itertools
  6661 python-wcwidth
  6660 python-py
  6660 python-pluggy
  6660 python-atomicwrites
  6657 python-six
  6593 python-mock
  6587 python-appdirs
  6586 python-lxml
  6584 python-filelock
  6584 python-distlib
  6583 python-sortedcontainers
  6580 python-hypothesis
  6577 python-elementpath
  6576 python-xmlschema
  6575 python-pytest
  6303 python-libxml2
This approach misses "end user" packages such as browsers and QEMU, but provides some insight into high value targets.

For end user packages, Debians "popularity contest" can be useful:

https://popcon.debian.org/

Re: Finding Critical Open Source Projects

#57
post #45

Earlier quoted context omitted.

The criteria https://github.com/ossf/criticality_score/blob/main/README.m... are designed to give higher scores to projects that are updated frequently by many contributors from different organizations, so of course the random Nebraskan's critical project is going to get a low "criticality score".

> of course the random Nebraskan's critical project is going to get a low "criticality score" ...which is the exact opposite of what it should be.

That is not true, check out this as an example - https://groups.google.com/g/wg-securing-critical-projects/c/.... We are just trying to help, so please provide constructive feedback and any ideas on metrics we can use.

Re: Finding Critical Open Source Projects

#58
post #47

Earlier quoted context omitted.

Definitely needs more work. The main Go SQLite3 for accessing SQLite databases is in the top "C" list. But SQLite itself doesn't seem to be included in any of them. o_O

That's probably because SQLite doesn't use git, and this tool seems to require git. Actually, in its current state it seems to require GitHub: https://github.com/ossf/criticality_score/blob/main/critical... This probably omits some other projects as well which don't use git or GitHub.

Yes correct. Right now, we are query-ing projects hosted on Github, but will be expanding to our source control system in the near future.

Re: Finding Critical Open Source Projects

#59
post #26
post #9

Top 10: - Python: salt, core ( https://github.com/home-assistant/core ), pandas, scikit-learn, numpy, airflow, erpnext, matplotlib, pytest & pip - Rust: servo, cargo, rust-clippy, tokio, rust-analyzer, tock, tikv, alacritty, libc & substrate - JS: node, react-native, react, gatsby, three.js, bootstrap, material-ui, odoo, next.js & Rocket.Chat - Java: elasticsearch, flink, spring-boot, hadoop, netty, jenkins, beam, ba…

In what universe Bazel is a critical project for Java ecosystem?

The list captures projects written in the Java language, not for Java ecosystem. See why it is critical here - https://github.com/bazelbuild/bazel/wiki/Bazel-Users

Re: Finding Critical Open Source Projects

#60
post #44
post #9

Top 10: - Python: salt, core ( https://github.com/home-assistant/core ), pandas, scikit-learn, numpy, airflow, erpnext, matplotlib, pytest & pip - Rust: servo, cargo, rust-clippy, tokio, rust-analyzer, tock, tikv, alacritty, libc & substrate - JS: node, react-native, react, gatsby, three.js, bootstrap, material-ui, odoo, next.js & Rocket.Chat - Java: elasticsearch, flink, spring-boot, hadoop, netty, jenkins, beam, ba…

Interestingly missing from the list: LLVM, SQLite, Postgres.

They are there:

cplusplus_top_200.csv:llvm-project,https://github.com/llvm/llvm-project,C++,48,0,2573,5,652.3,2...

c_top_200.csv:postgres,https://github.com/postgres/postgres,C,124,0,50,5,41.1,52,1,...

sqlite sorry since it is not hosted on github, and we do plan to add non-github repos in future.

Post reply on HN