3 ms·
From a more general security perspective, I've recently been thinking about the attack vector of open source followers. If you are a malicious open source proj
by daenz 7y ago
From a more general security perspective, I've recently been thinking about the attack vector of open source followers. If you are a malicious open source project owner, your project's follower/star list is a goldmine for potential attack targets. Likely the degree that someone likes/watches/follows your project is highly correlated to their use of your project personally/professionally. A bad actor could tailor their attacks based on this information.
- jdsully 7y agoI run KeyDB which is a medium sized OSS project. Stars and followers go up after we're posted somewhere but it doesn't necessary correlate directly with downloads. It's a best a leading indicator of what our downloads will do over the next month. I suppose its a better indicator than random, but I don't think it's very useful. You're much better off looking at Stack Share or job postings where this information is given away freely.