3 ms·
> Yet it seems to be a popularity contest people care about for some reason Before you incorporate someone's Github library into your own project, you want to
by MetaWhirledPeas 4y ago
> Yet it seems to be a popularity contest people care about for some reason
Before you incorporate someone's Github library into your own project, you want to know some things. Is it secure? Is it well-maintained? Is there an active userbase to help with support? Stars are one indicator of this.
- toastal 4y agoHardly. I was on a project with a JS dependency with 6.5k stars and sponsors but it injected a remote script at runtime without consent. I'm also a part of niche community circles where a project would be lucky to break 50 stars despite having phenomenal value and quality. It really is purely a popularity contest and only that with a bias towards other languages and projects that are equally as popular.
- yreg 4y agoan indicator is not a proof
- viraptor 4y agoHonestly, I would rather go for that specific info instead. CVEs for security, network graph and PRs for activity, CI maturity for security and maintenance, etc. Stars give you mostly popularity which is not necessarily correlated. But yeah, I agree they can be a single-number-proxy for the above.