20 ms·
4.5M Suspected Fake Stars in GitHub
- ocean_moist 2y agoThe github social media features are so weird I get around 10 follow requests per week from random people who follow >2k people something off happening there.
- mattbruv 2y agoI have the same thing happen to me often. Sometimes I get a notification on my GitHub homepage that someone followed me a day or so ago, and when I click to view their profile it seems that they have already unfollowed me. For example, This guy did it, and he has 6K+ followers and is only following ~200: https://github.com/NobleMajo https://github.com/NobleMajo. It seems weird that he would follow me to unfollow me right away. I have a feeling that these accounts do this intentionally to harvest followers by prompting Github to show a ton of different people that he is following them in order to have them follow back in exchange. I think most people will follow someone back who follows them without really thinking about it. In my case I investigated who it was who followed me and realized he isn't actually following me and is probably harvesting followers. Why would someone waste time out of their life to do this? Who knows. Probably want to feel special or stand out from other people without doing anything to earn it.
- mentalgear 2y agoIn a world with so much fake PR stuff and AI slop, any and all project that tries to verify what's real and what's not is an excellent choice of topic, fostering integrity again in the our industry. Here's the actual repo: https://github.com/hehao98/StarScout https://github.com/hehao98/StarScout
- hobs 2y agoAllow it a week to finish all iterations and expect it to read >= 40TB of data. You can use nohup to put it as a background process. After a week, you can run the following command to collect the results into MongoDB and local CSV files: I just love the yolo nature of "well let's check in a week if that 40TB of data processing worked"
- queuebert 2y agoReminds me of this famous paper: https://arxiv.org/abs/astro-ph/9912202 https://arxiv.org/abs/astro-ph/9912202
- krick 2y agoI suppose it must be a joke, but it's striking nevertheless how much clearer and better written this paper is. I absolutely hate these papers that have an abstract of "In this paper, we present a systematic, global, and longitudinal measurement study" and the conclusion of "In this paper, we have presented a systematic, global, and longitudinal measurement study". It's almost surreal that this, on the contrary, is not a joke, and the majority of papers are written in this idiotic manner.
- prepend 2y agoI don’t like stars as a metric. Or at least as a comparator. If you brag about having a millions stars that says something as a million is a lot. But if you brag that your project as a million and your competitor has half a million, that is so illogical that I would discount your project and think it’s run by dummies. Are there practical situations where people really need stars enough to buy them?
- hiccuphippo 2y agoMy only guesses are people showing popular repos for their CV or to appear legitimate to get access to another repo like what happened with the xz utils backdoor.
- deleted 2y ago[deleted]
- bdcravens 2y agoThere's also the third category of projects receiving funding.
- datadrivenangel 2y agoAnd for a while startups were using it as a traction metric for open core projects when pitching to VCs.
- pembrook 2y agoOnce you start trying to make a living from anything you do online, you start to realize that literally everything on the internet is gamed to extreme. Even this article was written and posted here for a reason. If your GitHub repo can in any way provide you with income (from just having something to talk about in an interview or an innocuous “buy me a coffee link”…all the way up to selling $100,000/yr enterprise support plans), you now have a strong incentive to game the system. And if it’s allowed by the system, then it’s a prisoners dilemma. Because if you DON’T do it, your competition will do it and eat your lunch. That’s why it’s so important to design high integrity ranking systems.
- deleted 2y ago[deleted]
- dang 2y ago(We merged comments from https://news.ycombinator.com/item?id=42573954 https://news.ycombinator.com/item?id=42573954 to this thread.) https://www.bleepingcomputer.com/news/security/over-31-million-fake-stars-on-github-projects-used-to-boost-rankings/ https://www.bleepingcomputer.com/news/security/over-31-milli...
- zitterbewegung 2y agoAll metrics will be gamed at some point. I don't know exactly how you could even fight this.
- jasoneckert 2y agoNeither do I. I believe the only thing anyone can do is take metrics of how the metrics are gamed, as this particular paper has done.
- jazzyjackson 2y agothere's various reasons webs-of-trust don't takeoff, but I can imagine a system where the metrics I see are only aggregated from friends-of-friends, and any other signal is just considered untrustworthy and therefor not worth observing
- drusepth 2y agoDo you still trust that system when your friends-of-friends are the ones gaming the system? Given the inherent network effects of manipulating webs of trust, I wouldn't be surprised if everyone had at least one friend-of-a-friend they shouldn't necessarily trust.
- morkalork 2y agoGiven all the obvious bots and sketchy recruiters that try to connect with me on LinkedIn, who all appear to have at least one mutual connection, it probably won't work.
- jagged-chisel 2y agoDo we have a similar issue on GH? I think the nature of the service and its target audience affect this problem in a big way. You can follow anyone on GH, but there's no mutual connection option at all. LI has following and mutual connections. LI also has a much wider audience. How might a 'connection' look on GH? Will people freely connect, or will they appraise requests more closely?
- dzonga 2y agodo stars even count ? my determination to use a project is 1. the readme 2. the issues
- tonymet 2y agorecent commits and community engagement are better indicators
- Retric 2y agoI’d generally rather use a library that hasn’t needed to update in 5 years than something in active development.
- insane_dreamer 2y agothe challenge is differentiating between "haven't need to update it in 5 years because it still solid and compatible with its ecosystem" vs "haven't updated it in 5 years because of any other reason"
- sixothree 2y agoSounds good in theory. But almost every time I use one of these projects, it's in "abandoned" status and definitely needs attention. There is 1 project I can point to that I use that does not actually need any maintenance and another that honestly makes me _extremely_ nervous to use because of lack of maintenance.
- mardifoufs 2y agoCan you give me some examples? Because in my experience even very stable, very "foundational" libs and frameworks that I know about and use almost never go 5 years without any commit/change. There's always either a small bug fix, or some update to a build script, updated documentation, or something. The only repos where that's not the case are usually very niche, and in that case it becomes very hard to judge if the library is just very stable or a minefield of bugs and undesired behavior that no one else reported because no one else is using it.
- attentionmech 2y agoI think number of clones is a much better metric (it's like proof of work, it needs compute to clone a repo). For me starring a repo is liking bookmarking it, nothing else. They might as well just mark it as "Bookmarked" instead of "Starred".
- nejsjsjsbsb 2y agoA better metric until it becomes a target. Once it is a target, getting a billion clones is trivial. Github should just stop showing star counts. Who cares about them.
- attentionmech 2y agoI think it's like a "upvote" thing which shows whether historically users have found the repo interesting. Even if you hide stars, there needs to be a way for the collective hivemind of github users to help each other with what repos are high quality or not right?
- rpdillon 2y agoYou don't need to crowdsource everything. I've never used stars as a good metric because it's literally zero effort. It's anybody who happens by just stars it, So all you can really conclude from star count is that this is interesting to this number of people. Two metrics that I think correlate extremely highly with quality: The number of commits in the repository and the date of the most recent commit. I've used a metric based on those two inputs for the past 15 years to evaluate repos and I am not disappointed. Depending on the nature of the project, I weigh the two attributes differently. Some projects are arguably, 'done', and so the date of the most recent commit is not very important in that case.
- michaelmior 2y agoI think "interesting to this number of people" is not a meaningless metric, but I would agree on the two other metrics you cite.
- lprd 2y agoDo we need that type of metric anyways? Surely there are better ways to measure a repo's activity...
- topspin 2y agoIt seems like a conceptionally simple problem to grade a repo given the vast number of metrics available. Especially considering the advanced code analysis tools available today. I want a top-level analysis of some sort, based on: usage by other software (if applicable,) activity, issue frequency and resolution, derivatives (forks, etc.,) number of participants, code maturity, code testing, release frequency, license structure and many other parameters. There is an opportunity here for a third party to do this well.
- ozim 2y agoGreat idea but I don’t know anyone who will pay for that. Ones that care enough already have their internal tools and processes for security and checking/reviewing libraries. Ones that don’t care well won’t spend money on it. So any 3rd party would have to do all with own resources and not getting paid.
- medv 2y agoThis means 4.5M fake accounts. GitHub does a good job of detecting bots, but room for improvements still exists.
- elashri 2y agoThat's not what the paper said. The numbers are much lower because not all starts are by unique accounts. > In total, StarScout identified 4.53 million fake stars across 22,915 repositories (before the postprocessing step designed to remove spurious ones), created by 1.32 million accounts; among these stars, 0.95 million are identified with the low activity signature and 3.58 million are identified by the clustering signature. In the postprocessing step, StarScout further identified 15,835 repositories with fake star campaigns (corresponding to 3.1 million fake stars coming from 278k accounts).
- ashvardanian 2y agoNot surprising at all, honestly. The incentive to farm stars is massive. According to the article, 10K stars can cost just $1K, whereas achieving those numbers organically often takes years of work, millions in R&D, and countless deployments. When this seemingly trivial metric becomes a key factor in unlocking capital from VCs, it’s no wonder people resort to shortcuts. In a way, the real surprise is that not everyone is buying stars.
- deznu 2y agoWhat’s there to gain though?
- halamadrid 2y agoAnother interesting way - and I personally think its fraudulent. This is how it goes - run hackathons or sponsor events in Universities. There are a ton of colleges who are constantly seeking support to run events. Some companies take advantage of this by asking for stars in return of sponsorship. I have seen proposals that say for a $2000 sponsorship - 2000 stars guaranteed. The way it works is if a participant registers in the event they also have to show proof that they starred a specific repo that belongs to the company.
- wslh 2y agoThat issue you are exposing is everywhere so if fraudulent is the word we can see that a lot of social media and Internet, in general, is also fraudulent. It is call-to-action and conversion everywhere.
- SOLAR_FIELDS 2y agoAh, so is the quid pro quo here that if I want to run a hackathon in my city I can get Acme Corp to toss their brand name on it and fund it, but only if I get my participants to also star the repo? That does sound fraudulent. Do they put these agreements in writing?
- kortilla 2y agoIt’s sleazy but not fraudulent.
- verst 2y agoAt many hackathons I attended (as a mentor, company sponsor, or judge) approximately a quarter of participants had never used GitHub previously. Such participants often thought of GitHub stars as bookmarks. Many hackathon sponsors provide Hackathon samples or references on GitHub - or guidelines for winning the specific sponsor's prize. As expected, those repos were "bookmarked" by the students. In this case this is a misunderstanding of the purpose of GitHub stars by these new users, but certainly not a fraudulent action.
- 2y ago
- simoncion 2y agoIMO, Github stars and number of "forks" are just as good a metric as "number of daily downloads" of a library or Docker image or similar. After noticing how many, many companies run many, many builds through their CI systems and (for a variety of reasons) end up re-downloading everything those builds require, regardless of whether or not it has changed since the last time they ran the build, I've come to the firm conclusion that these metrics are just plain bad if one uses them as a basis to make any significant decision.
- semiinfinitely 2y agosometimes I star my own github repos does that count as fake
- bdangubic 2y agoit doesn't if you really like it :)
- semiinfinitely 2y agoi do i really like my code thats why i typed it
- saagarjha 2y agoI wish I loved all my children equally
- openrisk 2y agoIf you were wondering about fake forks, spoiler alert > counts in Cluster 1 come from merchants that only sell stars, while accounts in Cluster 2 come from merchants selling stars and forks simultaneously
- johncoltrane 2y ago$PROJECT was bookmarked 666 times with GitHub's internal bookmarking mechanism doesn't say much about a project. The fact that so many people give those bookmarks so much value that an entire ecosystem was built around "fake" bookmarks is mind boggling.
- gitgud 2y agoGitHub Stars are just one of many signals that describe the quality of a project. If a project has 10,000 stars but 1 commit and a terrible README… then the star count doesn’t have as much weight… You can’t trust any signal in isolation (like star count), but looking at many signals together is quite reliable
- tacker2000 2y agoThis. Stars can be an initial indicator, but I also always skim the issues and the last commits, general activity, contributors, before deciding to use a some lib vs another for example.
- ivanjermakov 2y agoIn my experience, open/closed issues ratio is much more important than star count. Star count is how interested people are in this project, does not signify much about its quality. I would not star the repo of a tool I use everyday, but would star some obscure project to try it out later.
- jenadine 2y ago> In my experience, open/closed issues ratio is much more important than star count. What would you say is a good ratio?
- ivanjermakov 2y agoDepends on the project, but generally 1/4 is a threshold for "there are people working on issues". On smaller solo-dev projects it's often single digit open to hundreds of closed - very good.
- Der_Einzige 2y agoI wrote a whole benchmark which is not only resistant to this, but would automatically detect most fake stars! https://github.com/Hellisotherpeople/Bright https://github.com/Hellisotherpeople/Bright
- yencabulator 2y agoSo, make 100 bot accounts that each have 100 dummy repos and have each star all of other's repos, then start pumping those votes out of the network? Each bot has 10k incoming stars from users who each have 10k incoming stars. Remember, Google PageRank was bootstrapped with the N most visited websites.
- Der_Einzige 2y agoThis project already had no one caring about it 5 years ago. If github adopted my metric, than what you described would fool it. I wrote that as a weekend project one day after seeing the "fake github stars" thing 5 years ago.
- casenmgreen 2y agoI'm rather surprised it's only 4.5m.
- knowitnone 2y agogithub should be the ones doing this research, or at least sponsoring this but you know they won't because they don't care.
- cvoss 2y agoI've never once starred a GH project, nor ever looked at or considered the star count of a project in order to evaluate it. What do people actually use this metric for? (This is not a rhetorical question. If you use it, I'd like to know why/how.)
- wslh 2y agoHow do you bookmark projects at GitHub? Basically, it is not the same a library with less than 10 stars than some popular ones with ten of thousands. It is true that you can game the system butnstats are a signal in a domain that you don't know well.
- e-clinton 2y agoStarring projects is how I “bookmark” them so I can easily find them later. A high number of stars indicates many devs are interested in the project… if I had to chose a UI library with 10 stars versus one with 30,000 stars, it should be obvious why you’d pick the later. More interest likely means a bigger community behind the product.
- m2024 2y ago[dead]
- MattRix 2y agoI star repos as a way to bookmark them. I use the star counts as a rough metric for how popular a repo is. Something with a high star count will tend to have a larger community, more support, documentation, etc. Not always the case, but it can be a useful heuristic.
- alexk101 2y agoI like to keep track of interesting projects. It's basically just a bookmark for me.
- shepherdjerred 2y agoWhen I'm looking for a library I'll consider them in order of # of stars. e.g. I might search for "TypeScript ORM", open five popular repos, and then compare the two libraries with the most stars to make my decision. I also use stars to bookmark projects, and I'll usually unstar a project once I've tried it out/no longer need it.
- kittikitti 2y agoI think a repository should have at least 1 star, meaning at least the author liked it.
- a1o 2y agoNot directly related, but I have seen Ads in Stack overflow for GitHub repositories - not any notable repository, clearly just random people trying to get some stars for reasons.
- cute_boi 2y agoThe best solution is to github buy start themselves and ban all those users after 1-2 months, so they wouldn't even have a clue.
- imtringued 2y agoCobra effect
- yencabulator 2y agoWhat, the farmers will release their stars into the wild?
- remram 2y agoWhat's a "real" star on GitHub? Most real users will click the star button after reading the README, it does not indicate that they like it or even tried it. Having a "star on GitHub" button in a judicious place on your project's website will already over-inflate your number of stars regardless of your project's quality. You don't have to be a professional developer to get a GitHub account either. The age of a project (or more precisely, how long it's been on GitHub) also has a massive impact on the stars. What was ever so good about the "N strangers clicked the icon" metric? Even when those users were human with a higher probability? > posing a security risk to all GitHub users Please tell me no one takes the "N strangers clicked the icon in the past" as a signal of "today's releases won't harm my computer".
- nsoolo 2y agoIt is very easy to distinguish false stars, the important thing of a repository is not the stars but the activity of the contributors, I have seen many times repositories with malicious payloads with 1.7K stars or more.
- anshumankmr 2y agoHa, guilty as charged, I used the github profile that I had from my previous two companies to give stars to some of my favourite repos on my personal account.
- bawolff 2y agoWhat is even the point of stars in the first place. This is github not facebook. Who cares how many stars your open source repo has as long as it is useful to someone.
- albert_e 2y agosplit the current star function into a "star rating" and a "save bookmark" function let both users and repos opt out of / hide star ratings if they don't care about this popularity contest let bookmarks be always private to users -- so users can peacefully organize their bookmarks for what they are
- victorbjorklund 2y agoTrue. I usually only star projects that "cool. I wanna try this sometime but not cool enough to try now"
- RecycledEle 2y agoWhen people can make money off Internet credit, the con-artists take over and get more fake credit than the real creators earn. Then the con-artists drive away the real creators. This has happened on many other sites, and now I suspect it's happening on Git Hub.