criticality_score

LF OpenSSF "criticality score" for 100K Github repos, https://github.com/ossf/criticality_score & https://docs.google.com/spreadsheets/d/1uahUIUa82J6WetAqtxCM... > Generate a criticality score for every open source project. Create a list of critical projects that the open source community depends on. Use this data to proactively improve the security posture of these critical projects ... A project's criticality score defines the influence and importance of a project. It is a number between 0 (least-critical) and 1 (most-critical). It is based on the following algorithm by Rob Pike.. Top 20 projects, based on "criticality score" algo output, you can run the script on your favorite OSS project: > node, kubernetes, rust, spark, nixpkgs, cmsSW, tensorflow, symfony, DefinitelyTyped, git, azure-docs, magento2, rails, ansible, pytorch, PrestaSho

The criticality score in the referenced post about critical projects [1], the resulting projects [2] and the the "combined" list of various other sources of critical projects [3][4] all don't seem particularly on-point to me. Particularly the criticality score ratings seem just about entirely useless. Mostly seems to reflect different kinds of workflows. Using things like comment frequency etc will never get at the type of projects the xkcd comic in [1] is about. [1] https://opensource.googleblog.com/2020/12/finding-critical-o... [2] https://github.com/ossf/criticality_score#public-data [3] https://github.com/ossf/wg-securing-critical-projects#how-we... [4] https://docs.google.com/spreadsheets/d/1ONZ4qeMq8xmeCHX03lIg...

Honk! I represent Google on the OpenSSF, and help lead our Google Open Source Security Team. We've kicked off several projects inside the OpenSSF, and contribute to several other related efforts. Here's a non-exhaustive list: Security Scorecards (https://github.com/ossf/scorecard): auto-generated security checks for OSS, Criticality Score (https://github.com/ossf/criticality_score): auto-generated criticality score for OSS, Package Feeds (https://github.com/ossf/package-feeds): watches package registries for updates, malware analysis tools, SLSA (https://github.com/slsa-framework/slsa): proposal for a supply chain integrity framework, Sigstore/Cosign (https://sigstore.dev/): code signing made easy! We are also investing and exploring different efforts for improving security of critical OSS projects, and making it sustainable! If any of th

There is no exclusive focus, we are just starting somewhere where we can see the various metrics. Plan is to expand to non-github projects and other places (like custom issue trackers), but this is not straightforward as it sounds. Ideas welcome!. https://github.com/ossf/criticality_score/issues/29

Thanks for your feedback, we do want to fix this. And we do agree that there are several critical packages missing that don't use all metrics on github, plus non-github projects. Capturing this in https://github.com/ossf/criticality_score/issues/21

Thanks for feedback, adding it for analysis in https://github.com/ossf/criticality_score/issues/23

We are working on this problem, it is not simple. Identifying dependency trees reliably across languages is not straightforward [only nice for package manager ones]. Follow https://github.com/ossf/criticality_score/issues/8

filed https://github.com/ossf/criticality_score/issues/23

Filed https://github.com/ossf/criticality_score/issues/20, we will fix this, have an idea on the issue.

That's probably because SQLite doesn't use git, and this tool seems to require git. Actually, in its current state it seems to require GitHub: https://github.com/ossf/criticality_score/blob/main/critical... This probably omits some other projects as well which don't use git or GitHub.

The criteria https://github.com/ossf/criticality_score/blob/main/README.m... are designed to give higher scores to projects that are updated frequently by many contributors from different organizations, so of course the random Nebraskan's critical project is going to get a low "criticality score".

There are some issues with the criticality score (https://github.com/ossf/criticality_score). For example, it counts the number of issues as determining criticality. If there is any kind of money attached to this score (now or in the future), obviously this is going to encourage people to introduce more bugs into their projects.