5 ms·

Good news for the Ruby ecosystem, but I'd also like to get a handle on exactly how many of the most popular gems have "over 180 million total downloads".

• qrush 4y ago
  Many: https://rubygems.org/stats https://rubygems.org/stats You can also get database dumps here to dig further: https://rubygems.org/pages/data https://rubygems.org/pages/data
• jacques_chester 4y ago
  Approximately 100 gems, representing about a third of downloads. The original plan was to target based on download rankings, but these fluctuate, so in theory gems could be added and then removed from the list. A count of downloads can only go up.
  • nkantar 4y ago
    Were download rankings combined with one-way "membership" considered? (One-way "membership": once a gem/user qualifies based on recent downloads, they're permanently required in perpetuity.) This seems to be like it would mitigate the on/off problem of using a variable metric while also being biased to the currently relevant gems/users.
    • jacques_chester 4y ago
      IIRC we figured it would be more confusing than helpful.
      • nkantar 4y ago
        That makes a lot of sense, actually.
• londons_explore 4y ago
  Remember that 'downloads' is only half the metric that matters... Really 'users' is what matters, but a single download could lead to the code being used by a large platform provider and that code handling the private data of 1 Billion users. So, you really want every possible assurance that that code does what it says. And MFA is a good start for that.
  • jacques_chester 4y ago
    It's true that download count is a coarse metric, but it's the one we chose on this occasion to start with a manageably-sized cohort. As it happens I gave a talk[0] about how to rank projects according to their risk. A surprisingly difficult topic. [0] https://www.youtube.com/watch?v=T_Lrb2rYLps https://www.youtube.com/watch?v=T_Lrb2rYLps
• yxhuvud 4y ago
  That is what happens if you have CI systems that doesn't cache sufficiently aggressive.