3 ms·
Things like this are part of why I cringe when I see supply chain analysis/security companies include “popularity” in their criticality metrics: the relationsh
by woodruffw 4y ago
Things like this are part of why I cringe when I see supply chain analysis/security companies include “popularity” in their criticality metrics: the relationship between public popularity signals (like GitHub stars) and criticality is weak, at best.
- andrewmcwatters 4y agoIn my experience, it's actually a great signal. That's why so many people rely on it. The distribution of GitHub stars is an extreme power law.[1] Stargazer thresholds are used by maintainers to make decisions on including projects for different purposes from dependency management to package manager maintainers deciding to list software by name.[2] [1]: https://github.com/andrewmcwattersandco/github-statistics https://github.com/andrewmcwattersandco/github-statistics [2]: https://github.com/Homebrew/brew/blob/master/docs/Acceptable-Casks.md#rejected-casks https://github.com/Homebrew/brew/blob/master/docs/Acceptable...
- woodruffw 4y agoSelection suitability and criticality are different metrics. The former is what Homebrew uses, as a way to lessen maintainer load and prevent inclusion in Homebrew becoming its own quality signal. The latter is what I’ve seen supply chain companies provide: an implication that a project is somehow critical or essential to the overall ecosystem because it has so-and-so many stars. That first use is not unreasonable, in my opinion. The second one is questionable, at best.