5 ms·

Top 10: - Python: salt, core (https://github.com/home-assistant/core https://github.com/home-assistant/core), pandas, scikit-learn, numpy, airflow, erpnext, ma

• EvilEy3 6y ago
  In what universe Bazel is a critical project for Java ecosystem?
  • lokedhs 6y ago
    The Google universe. Don't they use it for all their builds?
  • tziki 6y ago
    In the Android universe?
  • leegraham 6y ago
    It looks like it's in the Java section because it's written _in_ Java, not because it's critical _to_ Java. Similarly, php-src isn't critical to C.
  • abharya 6y ago
    The list captures projects written in the Java language, not for Java ecosystem. See why it is critical here - https://github.com/bazelbuild/bazel/wiki/Bazel-Users https://github.com/bazelbuild/bazel/wiki/Bazel-Users
• megous 6y ago
  Which of these match the image in the article, where some random Nebraskan is maintaining some obscure dependency?
  • yorwba 6y ago
    The criteria https://github.com/ossf/criticality_score/blob/main/README.md#criticality-score https://github.com/ossf/criticality_score/blob/main/README.m... are designed to give higher scores to projects that are updated frequently by many contributors from different organizations, so of course the random Nebraskan's critical project is going to get a low "criticality score".
    • eeZah7Ux 6y ago
      > of course the random Nebraskan's critical project is going to get a low "criticality score" ...which is the exact opposite of what it should be.
      • abharya 6y ago
        That is not true, check out this as an example - https://groups.google.com/g/wg-securing-critical-projects/c/vt3NNkh1Zfs https://groups.google.com/g/wg-securing-critical-projects/c/.... We are just trying to help, so please provide constructive feedback and any ideas on metrics we can use.
        • carapace 6y ago
          I'm not sure if this is relevant, but bash and the readline lib are both maintained by a single unpaid volunteer. (I don't know if he's from Nebraska though.)
        • yorwba 6y ago
          Gensim is #119 in the list according to your link, far behind projects with many more active contributors, so hardly a resounding success of your scoring method. In terms of metrics, you could start by weighing projects with few contributors as more critical, not less. Specifically, gensim does appear to have had quite a few contributors, but the bulk of the code was written by the single maintainer https://github.com/RaRe-Technologies/gensim/graphs/contributors https://github.com/RaRe-Technologies/gensim/graphs/contribut... So maybe you should add a metric "percentage of code in the past year authored by the top contributor". If you want to go about it in a more data-driven fashion, you could go through the top projects for each language, check whether they actually need your support (e.g. find out what the development goals are, ask whether the current resources are sufficient and what they'd do with the additional resources you can provide) to get a ground-truth labeling of critical projects, then readjust your weights to match the ground truth.
• stonogo 6y ago
  I'm interested in the gulf between low-level systems code and effectively end-user code here. Things like GLib, Cairo, Harbuzz, etc -- none of the end-user tools work without them. It really demonstrates just how difficult this evaluation can be.
  • abharya 6y ago
    It is definitely difficult especially with critical dependencies. We are looking for any criteria to identify these in automated fashion. Parallely, for ones we know about those are we are trying to run our automated tools on. E.g. glib, cairo, harfbuzz are all continuously fuzzed as part of OSS-Fuzz - https://github.com/google/oss-fuzz/tree/master/projects https://github.com/google/oss-fuzz/tree/master/projects
• TAForObvReasons 6y ago
  Some de-duplication is needed. 12, 13, and 14 for JS are amphtml
  • abharya 6y ago
    That is a bug, will be fixed soon.
• bayindirh 6y ago
  C++: Eigen (the linear algebra and matrix library powering tensorflow and many more projects).
• eeZah7Ux 6y ago
  The results are really flawed.
• justinclift 6y ago
  Definitely needs more work. The main Go SQLite3 for accessing SQLite databases is in the top "C" list. But SQLite itself doesn't seem to be included in any of them. o_O
  • jchw 6y ago
    That might be because sqlite isn’t on Github.
    • justinclift 6y ago
      Yeah, that could be the case. That being said, lots of projects aren't on GitHub, and SQLite does have a mirror there which is kept up to date: https://github.com/sqlite/sqlite/ https://github.com/sqlite/sqlite/
      • abharya 6y ago
        The issue with the mirror is we don't get the important stats to make decisions. E.g. number of contributors, issue changes due to custom issue tracker. We are still thinking on how to add information from such cases in automated fashion, ideas welcome!
        • justinclift 6y ago
          Would it be feasible to add support for Fossil, so it's not just a git-only tool?
  • arp242 6y ago
    That's probably because SQLite doesn't use git, and this tool seems to require git. Actually, in its current state it seems to require GitHub: https://github.com/ossf/criticality_score/blob/main/criticality_score/run.py#L37 https://github.com/ossf/criticality_score/blob/main/critical... This probably omits some other projects as well which don't use git or GitHub.
    • 6y ago
• nine_k 6y ago
  Interestingly missing from the list: LLVM, SQLite, Postgres.
  • abharya 6y ago
    They are there: cplusplus_top_200.csv:llvm-project,https://github.com/llvm/llvm-project,C++,48,0,2573,5,652.3,22,27,27,1.5,40148,0.84165 https://github.com/llvm/llvm-project,C++,48,0,2573,5,652.3,2... c_top_200.csv:postgres,https://github.com/postgres/postgres,C,124,0,50,5,41.1,52,1,1,1.0,4859,0.62788 https://github.com/postgres/postgres,C,124,0,50,5,41.1,52,1,... sqlite sorry since it is not hosted on github, and we do plan to add non-github repos in future.