Github Has A SERIOUS Problem | Prime Reacts
Vložit
- čas přidán 17. 08. 2023
- Recorded live on twitch, GET IN
/ theprimeagen
Blog article: the-guild.dev/blog/judging-op...
Written by: Yassin Eldeeb - / yassineldeeb7 | Aleksandra Sikora - / aleksandrasays
MY MAIN YT CHANNEL: Has well edited engineering videos
/ theprimeagen
Discord
/ discord
Have something for me to read or react to?: / theprimeagenreact
Hey I am sponsored by Turso, an edge database. I think they are pretty neet. Give them a try for free and if you want you can get a decent amount off (the free tier is the best (better than planetscale or any other))
turso.tech/deeznuts - Věda a technologie
A good indicator of a project’s credibility is the ratio of stars to issues. The more stars a project has, the more it is being used by others. The more it is used, the more issues arise, whether they are questions or problems.
ohh very interesting take!
or.. you can just use your whole brain instead of relying on few scalar indicators
@@Otomega1 But I want to be lazy.
@@Otomega1 Chill bro!
brb going to write a new bot to cover this
stars are “bookmarks” for a lot of people. ie: this looks good - i’ll come back for this later
stars don’t even mean people have cloned and built it
Yea exactly
That's pretty much what I do. I never even star the repos I keep going back to, and even those I've read through. I only star the ones I want to keep in mind, but which I'm not going back to for the time being.
Huh, I never look at stars. I've only ever used commit frequency / recency and github issues to check the health and "trustworthiness" of a github project. Frequency / recency tells you if it's actively being maintained / updated. Considering bugs are an inevitability, git issues tells you 1: how many issues have been caught and fixed; 2. how active the community is in reporting bugs, asking for features, etc.; 3: how engaged the maintainers are with the community and serving their needs.
For 3., the number of outstanding PRs is also a useful datapoint
💯
same here.
This.
Glad there are many of us doing this check 🚀
They should just change "star"⭐ to "bookmark" 🔖to try and shake off some of the gamey social-media-esque behavior that treats stars as "likes".
That's basically just project following, which GH already has. Stars should just be outright removed.
Maybe even go one step further and hide the amount of followers from the public. To judge project popularity, look at how often it gets commits and how many people the commits come from
I think there is a beta feature, where instead of stars, you have project lists.
I made a few: like, Libs, Apps, CLI, Tools.
@mgord9518 The problem there is that there's real industry value in searching for popular software. Sure, in theory, better software should be chosen because it's right for the job, but oftentimes, using the popular thing is necessary for recruiting, training, maintaining, getting security fixes, etc.
>using fake internet points as a measurement of value
Literally worthless.
Have a like!
I’ve seen a Googler on LinkedIn literally dismiss someone’s opinion (that was correct) because of GitHub stars. It’s insane.
No need to compare dicts
They're not supposed to be fake, they are supposed to be real endorsements. I look at them as "stars are positively correlative to the probability that any given project is trustworthy and vetted by the people who have starred it". I myself save my stars for projects which I really, really like, and sometimes for those that I don't like (Electron apps) but they are still useful and which I've vetted.
One step closer to the Empty Internet. Soon, someone will hook up an LLM to write issues and comments in issue threads and even some shitty broken code repositories, then hook it up to a finite state machine and some other shit to add emoji reactions to issue comments, and then let it smolder in the background for a few years on a thousand bot accounts. And when GitHub strikes back, there will be casualties, and actually useful code will get deleted.
You could buy likes the moment someone put that feature on a website. This isn’t new in any conceivable way.
@@doctorgears9358 People have known the way to prevent Sybil attacks for a very long time, yet nobody implements it: use Hashcash to increase the cost of faking accounts, etc. A real user won't mind if a web worker thread spins for a second in the background to compute some proof-of-work to complete an action, but it would be a major problem for a service that fakes user engagement. It is really straight-forward to implement, too, so I don't get why people are against it.
I choose to use github projects based on if it has recent commits, other thing good to check is the issues. The only time that I usually look at the stars is when I'm trying to find an active fork of a dead project, the fork with more stars usually is the active one.
I always check issues, if a projects has like 1000 stars with 2 issues, that to me is red flag, of coz this is the first time hearing about this
Yep. Commit/PR merge history is also there and it's hard to fake
Number of closed PRs that were merged is huge. I don't want to accidentally become the unofficial maintainer because I do give reviews and then try to upstream them to someone who didn't care if it fixes a bunch of bugs, we need to talk about the commit message format for the twenty I've collected and how I should squash these two here, yadda.
Some projects go out of their way to not accept fixes for issues that have been around forever and that's definitely a red flag. If robucup passing on my ruby code that fixes a deal-breaker and that's where your priority is at, I'm probably not implementing it in an enterprise environment ever.
Biggest red flags for me are:
- No commits made recently on an "active" project
- Tons of open pull requests
- Tons of open issues not being responded to and/or closed
- Old issues not being resolved
And now let's talk about open-office and useless commits it has.
I've always associated the number of stars for a project the exact same way that I associate social media follows for a user. The idea that Github stars measures the quality of a project is a completely new concept to me.
same lol, stars are like bookmarks no? so if it has a good readme i might star it, if it has recent commits and issues who have been responed to by the maintainers its a go for me
@@ninocraft1 Same! I use them as bookmarks for sure, I judge credibility by how active the project is (commit frequency, issues reported & fixed, etc) & in what projects it is a dependency.
I usually pick libraries based on if the documentation is fleshed out and if the library actually looks enjoyable to use.
@@ninocraft1 *psst* I'm a newbie. Don't tell anyone else, but that's what I thought that they were for as well, bookmarks! Haha... =]
[10:30] It might be an auto-incrementing counter, but metrics provided by the fake-metrics store may not have started at zero.
I personally don't really use stars to see if a project is good.
But that might be more from me using stars as a way of "I'll look at this later", but I do also use it sometimes as "oh, this is cool".
I decide if something is good by looking up what people say about it, trying it for myself, etc.
(I also look at how recent the last commit was, etc)
yeah, it's not a fork, but rather a spoon, a fapoon
Stars = bookmark
Next up: Github Copilot will rate everyone's repos based on importance
The problem is indeed that stars are used to estimate how active/good/valid a project is
My mom picks important things in her life by how she feels about its auto. But she's also an idiot who would be homeless if not for family that knows how she is. If you work for a company that cares about stars to make engineering decisions, get out now.
yeah right... if it were that way, I should have at least 500+ stars on a project I put over 1000 hours in. I got one.
@@Antagon666how many people use your project?
@@Antagon666 because it's not noticed which means it's not used in prod which means devs can't ensure its validity or quality
@@Antagon666 because it's not noticed which means it's not used in prod which means devs can't ensure its validity or quality
I generally barely register internet points. Even on CZcams, the top rated comments are 90% of the time running gags or "pop jokes" that follow a similar format: They are hardly original and worthy.
So likes barely mean anything, dislikes mean actually more. Don't trust the flex numbers...
Except of course John Carmack's 100K github star Helloworld program.
Reminds me of a Dr Seuss book, The Sneetches, my kid has.
"Now, the Star-Belly Sneetches
Had bellies with stars.
The Plain-Belly Sneetches
Had none upon thars."
Whenever I am trying to decide on what library to use stars are only one factor. It’s good for narrowing stuff down quickly but then I like to compare the commit histories. I would much rather use a less popular library that is more actively maintained. Then the third thing that completely overrides everything else is if I just like the implementation over another.
How to tell if a project is good:
- solves your problem
- good open/closed issue ratio
- open issues are for niche corner cases, not fundamental flaws
- small dependency tree
- no mention of docker in readme
- source code looks straightforward
You seem like a taker not a maker. Open issues can fk off usually
Insight/Contributors gives a pretty good idea of the strength of the community - at least for larger projects. Also, the number of closed issues vs open issues. On a good project the majority of issues will be fixed.
I had a task to star a repository as part of the intership hiring process to show github skills, like wtf
Lol, was it one of their repos?
@@stoogel of course it was some ai project.
I've always used stars as bookmarks, oh this is a cool library I might use in the future
Same
Someone in the chat asked if you could buy stars for other repos. Exactly my thoughts! Someone can buy stars for other repos to lower their credibility.
I wish github had a poop emoji
I always thought stars just represent how many people bookmarked the project, and should be taken serious to the same extent you would take a watch later playlist on youtube.
Prime halfway the video: "Are we the baddies?"
I use stars as a way to bookmark projects I want to look at later lol
ive never used stars as a measurement of quality
its more of a measurement of popularity
a star is just a bookmark. you wanna buy a ton of bookmarks? be my guest. it's not going to influence my opinion of your project.
Doubt the order# started at 00001. When you open a checking account, most banks let you choose your starting check numbers. You'd do that for the same reason, because if you had order number #00020 or check #20, many ppl would be suspicious.
I don't believe I've ever starred a repo. I only use it as one of a handful of metrics for gauging community usage, and whether I should use something else or write it myself.
They might have initially incremented the counter to look like it's more popular than it actually is.
After Github create Lists where you put anything that you star in a list, I stopped caring about stars as special repositories.
I use to organize open source projects about subjects.
- Database: Repositories about databases
- Data science: Repositories about data science
- Security: Repositories about security softwares
Stars lost their worth with this change to create List using them (it should be a complete different thing from stars)
But now I question everything... NPM downloads per month can be just as easily bought then downloaded by bots that are much harder for NPM to detect since there are no profiles associated with the downloaders.
I like to look at number of open/resolved issues and commit frequency.
If I were trying to get people to believe my service was legitimate (e.g. a way to buy bot engagement), I would not start my auto-incrementing counter at zero.
10:49 yeah I’m considering buying stars… but for repos I love
"you'll get paid in github stars... I mean exposure"
Stars have never been a good way to judge an open source project, in the same way that likes / followers / upvotes have never been a good way. When someone votes on something, stars it, follows, whatever, it's a reflection of THEM, and how THEY feel about the thing in question. No one is upvoting / starring / liking / etc based on what is objectively true or good. Think about it, if someone posts a comment that uses harsh language that you don't like BUT the comment is absolutely 100% correct, you're not upvoting it just because it's an important part of the truth of the situation, you're downvoting it because you think the person is mean/rude/etc. The same goes for all kinds of media/content, including source code. People aren't running benchmarks on the code or comparing the algorithmic complexity, they're judging how it looks and feels when they work with it (whether that's integrating it into their project or experiencing the result of it as an end-user). This assertion that Github stars are somehow sacred and meaningful is a very naive take, in my opinion.
If you make technical decisions based on the number of stars you deserve it honestly
More like vc capital allocation decisions lol
Yeah that works, just yesterday I bought some stars to see and the work is done
THE FAULT IN OUR STAIRS LOL. WHT DA DOC DOIN.
I wonder if GHs enforced 2FA that takes place in September will reduce the amount of bots able to provide this service
3:22 I also look at their issue velocity. Do they leave issues and merge request open. Oh and commit history. Stars first though.
There are other issues related to users' credibility. Like faking followers count and faking a fully green activity board.
Nobody cares about your followers and current streak activity on GH. The main focus is on the actual repo and the activity related to it, such as commit history, forks, issues, PRs, stars etc.
@@ThisDaveAndThatJohn some hiring managers do care
@@medilies hm, I've honestly never heard about this. What I've heard tons of times is that curriculum vitae should literally be a single A4 size PDF page, all black&white and no other crap because it will be fed to an indexing tool. I feel like people want concrete stuff, so If you visit my GH, then you really want to see how good my code is and what kind of projects I've created and/or contributed to over time.
I’ve always used weekly downloads. If something has like 20k weekly downloads that’s usually fine. There’s exceptions, a lot of terrible library’s are popular but its a good starting point.
I don't look at stars as long as they're over a certain number
it seems the shop offer more than just github stars service, so 57k orders are probably the sum of all services
I for one do not doubt Carmack's ability to write an amazing hello world if he so chose.
i bet people could speed run it by breaking some bounds checking
personally i look at how many commits are there and how recent they are; also some comments
maybe a potential soft solution (because they would just make new accounts) would be to limit the number of stars someone can have, or maybe some kind of a verification step thats unique enough to make it harder to create new accounts but people who complete it are allowed "unlimited" stars.
My sense is it doesn't matter how many stars a github project has, just that it has them, which makes this all the more destructive.
Non-Recent commit history -> thin ice stability unless it's written in C.
If written in C, the older the better
My license3j has almost 500 stars, though it is functionally nothing but properties files digitaly signed. Very simple.
Jamal, which is much more complex, a lot more work and imho should be valuable for more people has only around 50.
I star stuff that I personally like. I don't care about amount of stars, I thought that is for bookmarking stuff. I am happy if I find something new that is cool. I could not care less how my github account looks like. It has some stupid Ultima Online code in there, that loads maps lightning fast in python using struct, which is a very useless implementation in this day and age, amongst other things. Yes, being respected and famous would be cool, but then, why, if I get jobs like I am anyway. I am rather under the radar. Behind the curtain.
Ah, I remember the days of "Ultima Online". My friend wrote some incredible scripts at the time. One was an auto harvesting of cows, and crafting down in Delucia. It would also run from the "reds" when they showed up. lol =]
I use the GitHub app on my phone and sometimes I browse the explore section for different programming languages that am interested in. Maybe it’s because of that but I find myself using the star as a sign for „I am Interessent in this project and might want to find it again“. It‘s just the fastest action to take in this exploration section and maybe therefore I never used staring as intentionally as Prime describes in this video. On the other hand I use star also as a measurement. So maybe I have to overthink my staring habit?
yeah to me stars is a "I'm interested in this" or "I use this". Since Github made star lists I've used it more and more like this, I have a bunch of different lists for programming languages and programs of stuff I'm interested in or have used/endorse. So they're not very purposely selected bc of code quality or anything, it just means I found the idea cool or have previously done something with it and so I starred it just in case I need it in the future.
No, you're using stars exactly as 1) GitHub intended it and 2) as everyone else does it. Stars are kind of a bookmark, not necessarily and endorsement. Watches could have a higher value, but still, consider than anyone can do it (including faked users/bots).
For me, stars can give me more interest to check something out, but I use it mainly as a bookmark for "check this out later". On Twitter I literally just use Bookmarks because it has the feature, and likes are more visible. Some things I just have interest in, but not interest in sharing my endorsment.
The real thing I learned in this video is that Netflix likes are for taste preference
order number 57k, nobody starts from 0 though, its probably only 56k actual orders
Everyone: how many stars means how good the reviews from buyers are.
Github: We'll sell you street cred. Don't think about it too much though.
Twin Peaks TV show will sell you a golden shovel for that stuff you're in now.
For me, GH stars are just bookmarks.
I don't star famous projects like Rust or Tokio or Anyhow. But I star something I may need in the future but can forget the name or the context.
You validated some of the stuff. I feel verified at last.
There’s stars?
Can I buy PRs fixing all the issues in my repo?
I'd pay for that
Yeah I think that's called hiring programmers
Stars is still just a popularity contest, if it was just quality then you have to agree that vscode is about 3x better than neovim.
Paranoia novice: Someone is following me😱 Paranoia master: I have 100k people following me😱
What is needed is a way to get stars from my following stars from github stars, stars from maintainers or committers of the top 100of each js rust go c packages. Etc.
Like show me the badge breakdown of the stars and forks. Show me all the stars that aren't from new accounts or people who don't commit more than user-provided-integer years
Basically I need a sqlite database of the stars and forls with a bunch of easy views built in
I'm checking to see the number of contributors & their amount of contribution. 🤷
Looking at stars is the equivalent of the VC's investing in FBX with no diligence
I think the stars are for the VCs
John Carmack's hello world would probably run on the GPU and perform 500x better than the usual example in any given language.
Chad Move of The Day:
Fuck GitHub, just write everything yourself.
See you in the next episode.
Github:
1. Create a new account
2. Create a new dummy project repo
3. Buy stars
4. Scrape the usernames of the new stars and report them
NB - Projects that have bought stars before is other issue.
What about forks?
⭐From 451 stars to 528 ⭐ only 1 hour after this video dropped. Can't wait to check back in next week to see it at 10k
well at least we still know that a library with 0 stars and a single contributor is not a good foundation for your new big corp project :)
19:02 agenn't?
if something is popular, can you really assume any level of trustworthiness? in the case of food within your own cultural context, yes you can. But for something technical that depends on too many constraints and those are not clear to us unless we have experience with the particular codebase, no. The way I see it, popularity on software development it can only amount to *"Lowest Common Denominator"* in the best of the cases, and that is what github stars have always meant to me.
I couldn't see the Bee's.
The important thing is we renamed master to main!
9:44 they started at 57000
Dude stars are just my bookmarks.
I think regardless if you can buy stars, it's probably not a great measure. I star things all the time just because they look interesting. And then I never actually end up using or doing anything with it. It's just like a bookmark that I might or might not come back to some time in the future. I apologize for being an NPC.
Primeagen when he realized he is making marketing fo paid github stars:
I've become marketing, the destroyer of open source
I never look at stars to see if I want to use a project. It's exclusively the last change. Now, I'm not really a programmer, but if this repo hasn't sent a change in 2+ years, it's not worth using.
I have a friend who would 100% buy GitHub stars to get into job interviews.
"ThePrimeagen"? Is this a Turok reference ffs? B)
Yayaya
Great tutorial! 10 stars from me
Quality proxies are eroding everywhere.
Eventually those start gonna be considered as bots and will fall off after some time due to bans. Thats why it's pretty meaningless to worry much about them.
Stars is a good indicator to know whether project has traction or not, and how much it is used. Buying stars makes it possible for malicious users to publish libraries and make them look legit, or for people who want to make their Github profile look better, kinda expected that there would be a merket for it.
See, if I open a github project and the most prominent feature of their README is a graph or some sort of brag about how many stars they have, I just close the tab. Like if you care about stars so much that you feel the need to reiterate the fact then I don't trust that your project's priorities are correct.
Sorry Prime, but I have to disagree (3:08). Yes, that's a bad way to do it. People star things for a variety of reasons, many of which may be totally unrelated to your use case. To me, it's always about the docs and the interfaces. If I can't comfortably read the docs or understand the interfaces documented therein, I'm out. Next library. If I can't find one that meets those standards, I'm building my own. Granted, my standards for that lower as my programming education expands, but that's because I don't feel comfortable putting code in my project whose purpose I don't fully understand. I don't go so far as to say I have to understand ALL the code in my project (though I'd prefer to), but I do need to have all the information about everything that can break in that code available in digestible format. That's why docs matter, kids. More than your GitHub stars.
This actually makes me want to document my Github projects more thoroughly.
"If something can be abused, it WILL be abused".
are premium stars even fake accounts? like they could be of somebody that sold it to the company
very well could be
14:40 i have no friends
You choose projects by stars? I mean, that's just a first guess. That should just be your... I bet you could analyze the avg years of likers or other metrics.
I have been using flutter for 3 years I gave it a star now 🤣
Well, I can still judge public opinion based on CZcams likes on a video. Same with Github stars. It still reflects the overall public opinion
Damn. Now I only trust repos with less than 10 stars.
saying advertisement are the same as buying likes/sponsors/stars/followers etc etc is ludicrous lmao
Why. People that buy likes and such are doing it for promotional purposes. AKA advertising. Granted, this is a square is a rectangle situation... not all advertising is like harvesting.
@@thomassynths its just reductionism taken to a silly degree imo, sure in a strictly definitional sense its true but there are some pretty clear differences in practice, its like the difference between grassroots organisation and astroturfing
Github search in general is abysmal.
How much does inheritance sucks and by translation, how much does Python sucks ? (since this language is litteraly based on inheritance)
I bet there are a lot of Twitter users who won't trust anyone without a certain number of followers.
Them we must all use php because 80% of websites are written in php
Or Java because 3 billion devices run Java