This doesn’t surprise me at all… Just like bots in games. Selling a service that benefits another. Its shady, but definitely believable.

Also, what if this is an actual viable way to “market” for an open source project?

https://www.bleepingcomputer.com/news/security/over-31-million-fake-stars-on-github-projects-used-to-boost-rankings

You are viewing a single thread.
View all comments View context
17 points

The stars are more important when you’re a developer. It indicates interest in the project, and when it’s a library you might want to use that translates into how well maintained it might be and what level of official and unofficial support you might get from it.

Other key things to look at are how often are they doing releases and committing changes, how long bugs are left open, if pull requests sit there forever without being merged in etc.

permalink
report
parent
reply
2 points
*

Yeah, this is a pretty good gauge of what an honest star rating should represent.

permalink
report
parent
reply
4 points

And if the developers were to give up on the project, how likely it would be for someone to fork it and continue.

permalink
report
parent
reply
1 point

Ya, that’s a really good point as well.

permalink
report
parent
reply
1 point

An experienced developer could easily step in. The hold back is getting compensated for the effort rather than being forced to turn tricks on the local street corner (aka work a job).

This is why devs are walking away.

Companies offering jobs to maintainers rather than directing funding at them is nonsense. Gov’ts and companies will wake up as cracks start snowballing in their tech stack.

permalink
report
parent
reply
1 point

Tbh I never look at stars, but do at prs and issues

permalink
report
parent
reply
1 point

Closed PRs and Closed issues?

What if it’s a side project with 1 star, 0 issues (because no one made any) and no PRs because no ones done work on it?

permalink
report
parent
reply
2 points

Really does depend on what we are talking about. Some random software that is not critical? Sure. Some system breaking library that would take down my servers in case of malfunction? No bueno.

permalink
report
parent
reply
1 point

More so if spme software had dozens or hundreds of open issues/PRs for months that never get looked at I’ll look elsewhere

Don’t want unstable dependencies

permalink
report
parent
reply
1 point

If you’re trying to peddle malware then it’s a way to fake popularity

permalink
report
parent
reply
1 point

That’s unfair. Throwing out FUD doesn’t make it true.

Why be in a rush to judge? Might wanna watch some projects which have used this tactic.

Might be legitimate projects are willing to do whatever to attract eye balls.

Just for shiats and giggles, keep an open mind.

permalink
report
parent
reply
2 points

I was pointing out a use case

permalink
report
parent
reply

Open Source

!opensource@lemmy.ml

Create post

All about open source! Feel free to ask questions, and share news, and interesting stuff!

Useful Links

Rules

  • Posts must be relevant to the open source ideology
  • No NSFW content
  • No hate speech, bigotry, etc

Related Communities

Community icon from opensource.org, but we are not affiliated with them.

Community stats

  • 3.4K

    Monthly active users

  • 2K

    Posts

  • 32K

    Comments