The criticality score in the referenced post about critical projects [1], the resulting projects [2] and the the "combined" list of various other sources of critical projects [3][4] all don't seem particularly on-point to me.

Particularly the criticality score ratings seem just about entirely useless. Mostly seems to reflect different kinds of workflows. Using things like comment frequency etc will never get at the type of projects the xkcd comic in [1] is about.

[1] https://opensource.googleblog.com/2020/12/finding-critical-o... [2] https://github.com/ossf/criticality_score#public-data [3] https://github.com/ossf/wg-securing-critical-projects#how-we... [4] https://docs.google.com/spreadsheets/d/1ONZ4qeMq8xmeCHX03lIg...