5 ms·

List of the top 200 is at : https://commondatastorage.googleapis.com/ossf-criticality-score/index.html https://commondatastorage.googleapis.com/ossf-criticalit

by sien 6y ago

List of the top 200 is at : https://commondatastorage.googleapis.com/ossf-criticality-score/index.html https://commondatastorage.googleapis.com/ossf-criticality-sc... (from the repo) So gnucash is #15 . At #75 is gcc . This seems like a great idea, but perhaps some refinements are needed.

abharya 6y ago
World is not perfect. In case of gcc, it is only a mirror on github [https://github.com/gcc-mirror/gcc https://github.com/gcc-mirror/gcc], so we dont get all the metrics, we do plan to improve this part [but this will be slow to clone repo, know their custom issue trackers, etc]. Gnucash is still a popular project, has like ~7k downloads a week, see wikipedia page.
- deleted 6y ago
  [deleted]
- breakingcups 6y ago
  Strangely enough that's not mentioned anywhere on the announcement. In fact, it seems to announce that very real funding decisions are going to be made based on this score already. How can you make accurate decisions based on inaccurate data? Which reminds me of that Babbage quote: "On two occasions I have been asked, 'Pray, Mr. Babbage, if you put into the machine wrong figures, will the right answers come out?' I am not able rightly to apprehend the kind of confusion of ideas that could provoke such a question."
- jcelerier 6y ago
  > Gnucash is still a popular project, has like ~7k downloads a week, see wikipedia page. omg they're actually doubling down on this. Libreoffice has something like 50k downloads per day and isn't listed, while among "critical projects" there is... minetest ? tesseract ? battle for wesnoth ? dolphin ? citra ? There's qt creator (and a ton of Qt-using projects) but not Qt ?
  - abharya 6y ago
    Thanks for your feedback, we do want to fix this. And we do agree that there are several critical packages missing that don't use all metrics on github, plus non-github projects. Capturing this in https://github.com/ossf/criticality_score/issues/21 https://github.com/ossf/criticality_score/issues/21
eitland 6y ago
Maven and Gradle both missing from top 20 on Java. Whatever one thinks about Java development, if those two tools disappeared most Java development world wide would stop. There would always be the lone developers deploying from IntelliJ/NetBeans/Eclipse and a few people using Ant/Bazel/Ivy but I must admit I haven't seen any of those "in the wild" the last three years.
ktpsns 6y ago
Jup. Amongst the 200 "most critical python libriaries" are for instance https://github.com/plamere/spotipy https://github.com/plamere/spotipy, a client API for Spotify. I don't believe that the majority of Python codes want to play spotify streams :-)
deleted 6y ago
[deleted]

by sien 6y ago

abharya 6y ago

World is not perfect. In case of gcc, it is only a mirror on github [https://github.com/gcc-mirror/gcc https://github.com/gcc-mirror/gcc], so we dont get all the metrics, we do plan to improve this part [but this will be slow to clone repo, know their custom issue trackers, etc]. Gnucash is still a popular project, has like ~7k downloads a week, see wikipedia page.

deleted 6y ago
[deleted]
breakingcups 6y ago
Strangely enough that's not mentioned anywhere on the announcement. In fact, it seems to announce that very real funding decisions are going to be made based on this score already. How can you make accurate decisions based on inaccurate data? Which reminds me of that Babbage quote: "On two occasions I have been asked, 'Pray, Mr. Babbage, if you put into the machine wrong figures, will the right answers come out?' I am not able rightly to apprehend the kind of confusion of ideas that could provoke such a question."
jcelerier 6y ago
> Gnucash is still a popular project, has like ~7k downloads a week, see wikipedia page. omg they're actually doubling down on this. Libreoffice has something like 50k downloads per day and isn't listed, while among "critical projects" there is... minetest ? tesseract ? battle for wesnoth ? dolphin ? citra ? There's qt creator (and a ton of Qt-using projects) but not Qt ?
- abharya 6y ago
  Thanks for your feedback, we do want to fix this. And we do agree that there are several critical packages missing that don't use all metrics on github, plus non-github projects. Capturing this in https://github.com/ossf/criticality_score/issues/21 https://github.com/ossf/criticality_score/issues/21

eitland 6y ago

Maven and Gradle both missing from top 20 on Java. Whatever one thinks about Java development, if those two tools disappeared most Java development world wide would stop. There would always be the lone developers deploying from IntelliJ/NetBeans/Eclipse and a few people using Ant/Bazel/Ivy but I must admit I haven't seen any of those "in the wild" the last three years.

ktpsns 6y ago

Jup. Amongst the 200 "most critical python libriaries" are for instance https://github.com/plamere/spotipy https://github.com/plamere/spotipy, a client API for Spotify. I don't believe that the majority of Python codes want to play spotify streams :-)

deleted 6y ago

[deleted]