5 ms·

> It checks contributor patterns too. If 90% of commits come from one person who hasn’t pushed in months, that’s flagged. IMO this is a slight green flag; not

> It checks contributor patterns too. If 90% of commits come from one person who hasn’t pushed in months, that’s flagged. IMO this is a slight green flag; not red.

lispisok 1y ago
It's gonna flag most of the clojure ecosystem
- throwaway150 1y ago
  Yep, and it's not just Clojure. This will end up flagging projects across all non-mainstream ecosystems. Whether it's Vim plugins, niche command-line tools, academic research code, or hobbyist libraries for things like game development or creative coding, they'll likely get flagged simply because they're often maintained by individual developers. These devs build the projects, iterate quickly in the early stages, and eventually reach a point where the code is stable and no longer needs frequent updates. It's a shame that this tool penalizes such projects, which I think are vital to a healthy open source ecosystem. It's a nice project otherwise. But flagging stable projects from solo developers really sticks out like a sore thumb. :(
  - artski 1y ago
    It would still count as "trustworthy" just wouldnt come out to 100/100 :(.
    - mattgreenrocks 1y ago
      Ironically your chance of getting a PR through is about 10x higher on smaller one-man-show repos than more heavily trafficked corporate repos that require all manner of hoops to be jumped through for a PR.
sethops1 1y ago
I have to agree - the highest quality libraries in my experience are the ones maintained that one dedicated person as their pet project. There's no glory, no money, no large community, no Twitter followers - just a person with a problem to solve and making the solution open source for the benefit of others.
artski 1y ago
Fair take—it's definitely context-dependent. In some cases, solo-maintainer projects can be great, especially if they’re stable or purpose-built. But from a trust and maintenance standpoint, it’s worth flagging as a signal: if 90% of commits are from one person who’s now inactive, it could mean slow responses to bugs or no updates for security issues. Doesn’t mean the project is bad—just something to consider alongside other factors. Heuristics are never perfect and it's all iterative but it's all about understanding the underlying assumptions and taking the knowledge you get out of it with your own context. Probably could enhance it slightly by a run through an LLM with a prompt but I prefer to keep things purely statistical for now.
- delfinom 1y ago
  The problem is your audience is: > CTOs, security teams, and VCs automate open-source due diligence in seconds. The people that probably have less brain cells than the average programmer to understand the nuance in the flagging.
  - artski 1y ago
    Lol yeah tbh - I just made it without really thinking of an audience, just was looking for a project to work on till I saw the paper and figured it would be cool to check it out on some repositories out there. That part is just me asking gpt to make the read me better.
- 85392_school 1y ago
  It could also mean that the project is stable. Since you only look at the one repository's commit activity, a stable project with a maintainer who's still active on GitHub in other places would be "less trustworthy" than a project that's a work in progress.
  - deleted 1y ago
    [deleted]
  - artski 1y ago
    Not a bad idea tbh, maybe an additional how long issues are left open, would be a good idea. Though yeh thats why I was contemplating of not necessarily highlighting the actual number and more have a range e.g. 80-100 is good, 50-70 Moderate and so on.
j45 1y ago
Not sure if this is a red flag.
255kb 1y ago
Also, isn't that just 99% of OSS projects out there? I maintained a project for the past 7+ years, and despite 1 million downloads, tens of thousands of monthly active users, it's still mostly me, maintaining and committing. Yes, there is a bus factor, but it's a common and known problem in open-source. It would be better to try to improve the situation instead of just flagging all the projects. It's hard enough to find people ready to help and work on something outside their working hours on a regular basis...

> It checks contributor patterns too. If 90% of commits come from one person who hasn’t pushed in months, that’s flagged. IMO this is a slight green flag; not red.

lispisok 1y ago

It's gonna flag most of the clojure ecosystem

throwaway150 1y ago
Yep, and it's not just Clojure. This will end up flagging projects across all non-mainstream ecosystems. Whether it's Vim plugins, niche command-line tools, academic research code, or hobbyist libraries for things like game development or creative coding, they'll likely get flagged simply because they're often maintained by individual developers. These devs build the projects, iterate quickly in the early stages, and eventually reach a point where the code is stable and no longer needs frequent updates. It's a shame that this tool penalizes such projects, which I think are vital to a healthy open source ecosystem. It's a nice project otherwise. But flagging stable projects from solo developers really sticks out like a sore thumb. :(
- artski 1y ago
  It would still count as "trustworthy" just wouldnt come out to 100/100 :(.
  - mattgreenrocks 1y ago
    Ironically your chance of getting a PR through is about 10x higher on smaller one-man-show repos than more heavily trafficked corporate repos that require all manner of hoops to be jumped through for a PR.

sethops1 1y ago

I have to agree - the highest quality libraries in my experience are the ones maintained that one dedicated person as their pet project. There's no glory, no money, no large community, no Twitter followers - just a person with a problem to solve and making the solution open source for the benefit of others.

artski 1y ago

Fair take—it's definitely context-dependent. In some cases, solo-maintainer projects can be great, especially if they’re stable or purpose-built. But from a trust and maintenance standpoint, it’s worth flagging as a signal: if 90% of commits are from one person who’s now inactive, it could mean slow responses to bugs or no updates for security issues. Doesn’t mean the project is bad—just something to consider alongside other factors. Heuristics are never perfect and it's all iterative but it's all about understanding the underlying assumptions and taking the knowledge you get out of it with your own context. Probably could enhance it slightly by a run through an LLM with a prompt but I prefer to keep things purely statistical for now.

delfinom 1y ago
The problem is your audience is: > CTOs, security teams, and VCs automate open-source due diligence in seconds. The people that probably have less brain cells than the average programmer to understand the nuance in the flagging.
- artski 1y ago
  Lol yeah tbh - I just made it without really thinking of an audience, just was looking for a project to work on till I saw the paper and figured it would be cool to check it out on some repositories out there. That part is just me asking gpt to make the read me better.
85392_school 1y ago
It could also mean that the project is stable. Since you only look at the one repository's commit activity, a stable project with a maintainer who's still active on GitHub in other places would be "less trustworthy" than a project that's a work in progress.
- deleted 1y ago
  [deleted]
- artski 1y ago
  Not a bad idea tbh, maybe an additional how long issues are left open, would be a good idea. Though yeh thats why I was contemplating of not necessarily highlighting the actual number and more have a range e.g. 80-100 is good, 50-70 Moderate and so on.

j45 1y ago

Not sure if this is a red flag.

255kb 1y ago

Also, isn't that just 99% of OSS projects out there? I maintained a project for the past 7+ years, and despite 1 million downloads, tens of thousands of monthly active users, it's still mostly me, maintaining and committing. Yes, there is a bus factor, but it's a common and known problem in open-source. It would be better to try to improve the situation instead of just flagging all the projects. It's hard enough to find people ready to help and work on something outside their working hours on a regular basis...