this post was submitted on 31 Dec 2024
435 points (99.1% liked)

Open Source

32061 readers
7 users here now

All about open source! Feel free to ask questions, and share news, and interesting stuff!

Useful Links

Rules

Related Communities

Community icon from opensource.org, but we are not affiliated with them.

founded 5 years ago
MODERATORS
 

This doesn't surprise me at all... Just like bots in games. Selling a service that benefits another. Its shady, but definitely believable.

Also, what if this is an actual viable way to "market" for an open source project?

https://www.bleepingcomputer.com/news/security/over-31-million-fake-stars-on-github-projects-used-to-boost-rankings

top 50 comments
sorted by: hot top controversial new old
[–] [email protected] 122 points 3 weeks ago (1 children)

Also cybersecurity implications here. Nefarious actors can prop up their evildoings with fake stars and pose as legitimate projects.

[–] [email protected] 27 points 2 weeks ago (1 children)

my first thought. I usually rely on stars for "trustworthiness" of random projects before running their code.

[–] [email protected] 2 points 2 weeks ago

Ironically an open source project with under 100 stars now seems more trustworthy by default because you can be sure they aren't lying

[–] [email protected] 64 points 2 weeks ago (2 children)

I almost commented something like "thats extremely overpriced, why dont you set up a raspberry pi to do it for you for free" and then i realized the people who could do that dont need fake stars.

[–] [email protected] 28 points 2 weeks ago (1 children)

How would the raspberry help? It is accounts needed.

[–] [email protected] 3 points 2 weeks ago (1 children)

Automation. You replace the user with a script that does everything. Not that hard. Captchas dont really work anymore with ai, and you can pay people to do it for you for a fraction of a cent instead of the absurd prices listed.

[–] [email protected] 24 points 2 weeks ago (4 children)

But you still need the user accounts. Which must be created and are verified by email. Then you have to generate tokens for them to call the api endpoint to add the star. I’m not saying it isn’t doable, but it would be non-negligible and GitHub is going to squash you back at some point creating all those accounts from one source.

[–] [email protected] 2 points 2 weeks ago

Right - the cost is your time instead of dollars.

I don't like doing stuff, so I give my time an hourly rate of $100. Absolute BEST case scenario (for me) would be that this is a weekend project, so call it 10 hours.

So my best case break-even point would be 10K stars. Which seems like it'd be more than I'd need?

load more comments (3 replies)
load more comments (1 replies)
[–] [email protected] 36 points 3 weeks ago (2 children)

What is Twidium's deal? They are the most expensive and take the longest.

[–] [email protected] 33 points 2 weeks ago (1 children)

Obviously their stars are the bestest

[–] [email protected] 20 points 2 weeks ago

Got to make it look organic and viral.

[–] [email protected] 27 points 2 weeks ago

Its not good that some of these are instant. I guess they try to make it look organic.

[–] [email protected] 24 points 2 weeks ago (1 children)

I am not a programmer. But I have been using github as an end user for years, downloading programs I like and whatnot. Today I realized there are stars on github. Literally never even noticed.

[–] [email protected] 16 points 2 weeks ago (9 children)

The stars are more important when you're a developer. It indicates interest in the project, and when it's a library you might want to use that translates into how well maintained it might be and what level of official and unofficial support you might get from it.

Other key things to look at are how often are they doing releases and committing changes, how long bugs are left open, if pull requests sit there forever without being merged in etc.

[–] [email protected] 4 points 2 weeks ago (2 children)

And if the developers were to give up on the project, how likely it would be for someone to fork it and continue.

load more comments (2 replies)
[–] [email protected] 2 points 2 weeks ago* (last edited 2 weeks ago)

Yeah, this is a pretty good gauge of what an honest star rating should represent.

[–] [email protected] 2 points 2 weeks ago (2 children)

If you’re trying to peddle malware then it’s a way to fake popularity

load more comments (2 replies)
load more comments (6 replies)
[–] [email protected] 23 points 3 weeks ago

Can we get a nice chart for Upvotes on Reddit costs? Asking for a friend. /s

[–] [email protected] 18 points 2 weeks ago (2 children)

There is a clear situation in Foss( even more in self hosting) where projects are presented as free open source but they are intended to monetize at the end and use the community help for development.

[–] [email protected] 2 points 2 weeks ago

This happened in the earlier years of Android. Developers were FOSS until people helped them get the app to a polished state. Then close it and charge money. Make a big push to promote the paid app.

[–] [email protected] 2 points 2 weeks ago (1 children)

Can you give examples of this? What is the coat to the end user? Hardware, IT-services (VPS, and alike?) or like map providers using OSM data?

[–] [email protected] 9 points 2 weeks ago (1 children)

Isn't this kinda what the controversy around the ElastiSearch licensing change was about? I think people have had similar frustrations with HashiCorp software, but I don't know the details.

[–] [email protected] 3 points 2 weeks ago (1 children)

In my opinion that was a little different. The enterprise was using the software basically, contributing nothing but selling services around it. The licence was meant to force them to help out monetarily from what they were making off it. But rather than do that Mason forked it and now have to support their own imp with their own devs.

load more comments (1 replies)
[–] [email protected] 16 points 2 weeks ago

You can buy any metric on the web. Amazon reviews, YouTube subscribers and likes, X followers, Reddit karma, …. I am not surprised that GitHub stars are one of them.

[–] [email protected] 13 points 2 weeks ago

On the Caveat Emptor ("Let the buyer beware") side of things, I look at other metrics well before I rely on stars.

How many contributors does it have? How many active forks? How many pull requests? How many issues are open and how many get solved and how often and how lively are the discussions? When was the last merge? How active is the maintainer?

Stars might as well be facebook likes imo: when used as intended, they didn't say much more than "this is what the majority of people like" (surprise, I'm on lemmy bc I have other priorities than what's popular), now they mean nothing at all.

[–] [email protected] 9 points 2 weeks ago

Shocking, a site full of diy programmers and hackers are trying to hack the system. Maybe even just for fun.

[–] [email protected] 9 points 2 weeks ago (4 children)

Programming never needed these sorts of social media features in the first place. Do you part by getting your projects off of Microsoft’s social media platform used to try to sell you Copilot AI & take a cut of your donations to projects with Sponsors.

[–] [email protected] 3 points 2 weeks ago (3 children)

For reference, there is codeberg.org, operated by a German nonprofit and based on the open source Forgejo, among other open alternatives.

load more comments (3 replies)
load more comments (3 replies)
[–] [email protected] 9 points 3 weeks ago (8 children)

Why would it be? Software is good based on it's use and recommendations from real folk, not *s. Many project not on github

[–] [email protected] 47 points 3 weeks ago (2 children)

But stars equal discoverabiliy, or at least contribute a good chunk to it.

[–] [email protected] 8 points 3 weeks ago

Sure if you browse by github but in my use of the site over the years I go to the repo from the webpage of the project or from another source such as a link from a blog or something.

[–] [email protected] 5 points 2 weeks ago

I never went with a software project from random scrolling. It has no value to me if it doesn't meet a need I have right now.

No contributor is going to be good that doesn't use it.

load more comments (7 replies)
[–] [email protected] 7 points 2 weeks ago

Also, what if this is an actual viable way to “market” for an open-source project?

I am fortunate enough to not market my stuff:

If somebody finds and can make use of it. Great.

In the other case who cares? Didn't hurt or cost me anything to publish it.

Fake GitHub stares have other implications: Typosquatting is a real issue and fake stars make it more convincing that it is the genuine project.

[–] [email protected] 6 points 2 weeks ago (1 children)

how is twidium managing to charge so much more?

[–] [email protected] 10 points 2 weeks ago

Their stars are hand crafted from raw virginal pixels by blind monks using only their toes.

[–] [email protected] 4 points 2 weeks ago* (last edited 2 weeks ago) (2 children)

For anyone interested in reading more on this type of thing, the colloquial term seems to be "SMM panel" where SMM is "social media marketing". EN Wikipedia has nothing of course, but DE has this: https://de.wikipedia.org/wiki/SMM-Panel.

[–] weker01 3 points 2 weeks ago

Why do you say it's obvious that the English wiki "has nothing"?

[–] [email protected] 2 points 2 weeks ago

Link doesn't work for me on mobile.

Why would the En version "obviously" have nothing?

[–] [email protected] 4 points 2 weeks ago (2 children)

Why a real person would star a project? When I star a project then my GitHub home is littered with activity from that project. I hate that, so I never star anything

[–] [email protected] 3 points 2 weeks ago

you can turn off notifications from starred projects

load more comments
view more: next ›