5 ms·
I use stars to try and protect myself from dependency confusion attacks. For example, let’s say I want to run some piece of software that I’ve heard about, and
by lukasgelbmann 5mo ago
I use stars to try and protect myself from dependency confusion attacks.
For example, let’s say I want to run some piece of software that I’ve heard about, and let’s say I trust that the software isn’t malware because of its reputation.
Most of the time, I’d be installing the software from somewhere that’s not GitHub. A lot of package managers will let anyone upload malware with a name that’s very similar to the software I’m looking for, designed to fool people like me. I need to defend against that. If I can find a GitHub repo that has a ton of stars, I can generally assume that it’s the software I’m looking for, and not a fake imitator, and I can therefore trust the installation instructions in its readme.
Except this is also not 100% safe, because as mentioned in TFA, stars can be bought.
- MrSandingMan 5mo agoWhat does "TFA" mean here please?
- bsuvc 5mo agoThe fucking article.
- tom_ 5mo agoThe article. Pick whatever adjective you like beginning with F!
- alternatetwo 5mo agoI think it's "The fucking article".
- inanutshellus 5mo agoYes and to be clear, one uses "TFA" to imply annoyance that TFA hasn't been read. e.g. "TFA covers this already."
- lukasgelbmann 5mo agoThat’s not something I wanted to imply. It can also stand for "the fine article". Is there a better shorthand for "the article linked at top of the page" / "the original article"?
- inanutshellus 5mo agoNope, one simply says "the article".
- ssl-3 5mo agoTFA works fine either way. It's OK that it is subject to interpretation.
- inanutshellus 5mo agoAnd for clarity to @lukasgelbmann - I answered the questioner that clearly didn't know the term. I wasn't referring to your usage of it. Context and tone tell the reader whether it's used "normally", tongue-in-cheek, or neutrally. ~\_O_/~ To ESL folk out there - the "F" definitely never means "fine". It's a cute and crass ... just like America. ;^)
- AgentMatt 5mo agoThe featured article.
- whatisthiseven 5mo agoSure, I suppose that is one solution, but given that buying stars has been around for at least 5 years, and I have been aware of people faking stars for longer than that, I am not sure why you would rely on stars as a primary metric. There are many other far more useful metrics to look at first, and to focus on first, and to think about. Every time you think about stars, you'll forget the other stuff, or discount it in favor of stars. Forget stars. They now no longer mean anything. Even if they did before, they don't anymore.
- ziml77 5mo agoInteresting that 5 years ago is exactly when this page showed up according to the Wayback Machine: https://docs.github.com/en/get-started/exploring-projects-on-github/saving-repositories-with-stars https://docs.github.com/en/get-started/exploring-projects-on... In it they explicitly call it out as a ranking metric > Many of GitHub's repository rankings depend on the number of stars a repository has. In addition, Explore GitHub shows popular repositories based on the number of stars they have. Yet another case of metric -> target -> useless metric