Finding Critical Open Source Projects

Re:Finding Critical Open Source Projects by sien on Friday December 11, 2020 @12:13AM (#25382548)

List of the top 200 is at :

https://commondatastorage.googleapis.com/ossf-criticality-sc...

(from the repo)

So gnucash is #15 . At #75 is gcc .

This seems like a great idea, but perhaps some refinements are needed.

[ Parent | on HN ]

Re:Finding Critical Open Source Projects by eitland on Friday December 11, 2020 @02:26AM (#25383292)

Maven and Gradle both missing from top 20 on Java.

Whatever one thinks about Java development, if those two tools disappeared most Java development world wide would stop.

There would always be the lone developers deploying from IntelliJ/NetBeans/Eclipse and a few people using Ant/Bazel/Ivy but I must admit I haven't seen any of those "in the wild" the last three years.

[ Parent | on HN ]

Re:Finding Critical Open Source Projects by ktpsns on Friday December 11, 2020 @06:46AM (#25384674)

Jup. Amongst the 200 "most critical python libriaries" are for instance https://github.com/plamere/spotipy, a client API for Spotify. I don't believe that the majority of Python codes want to play spotify streams :-)

[ Parent | on HN ]

Re:Finding Critical Open Source Projects by abharya on Friday December 11, 2020 @01:35AM (#25383006)

World is not perfect. In case of gcc, it is only a mirror on github [https://github.com/gcc-mirror/gcc], so we dont get all the metrics, we do plan to improve this part [but this will be slow to clone repo, know their custom issue trackers, etc].

Gnucash is still a popular project, has like ~7k downloads a week, see wikipedia page.

[ Parent | on HN ]

Re:Finding Critical Open Source Projects by breakingcups on Friday December 11, 2020 @04:45AM (#25383961)

Strangely enough that's not mentioned anywhere on the announcement. In fact, it seems to announce that very real funding decisions are going to be made based on this score already.

How can you make accurate decisions based on inaccurate data?

Which reminds me of that Babbage quote: "On two occasions I have been asked, 'Pray, Mr. Babbage, if you put into the machine wrong figures, will the right answers come out?' I am not able rightly to apprehend the kind of confusion of ideas that could provoke such a question."

[ Parent | on HN ]

Re:Finding Critical Open Source Projects by jcelerier on Friday December 11, 2020 @09:15AM (#25385991)

> Gnucash is still a popular project, has like ~7k downloads a week, see wikipedia page.

omg they're actually doubling down on this. Libreoffice has something like 50k downloads per day and isn't listed, while among "critical projects" there is... minetest ? tesseract ? battle for wesnoth ? dolphin ? citra ?

There's qt creator (and a ton of Qt-using projects) but not Qt ?

[ Parent | on HN ]

Re:Finding Critical Open Source Projects by abharya on Saturday December 12, 2020 @12:09PM (#25399706)

Thanks for your feedback, we do want to fix this.

And we do agree that there are several critical packages missing that don't use all metrics on github, plus non-github projects. Capturing this in https://github.com/ossf/criticality_score/issues/21

[ Parent | on HN ]