BoF: Defining Criticality - Which Open Source Projects Truly Matter?
summary
Group presents a data-driven rework of the OpenSSF Criticality Score inside LFX Insights, scoring the top 10,000 GitHub repos using six commit-log signals (contributor rank, distinct committers, org diversity, age, last update, commit cadence), assigns about 40% weight to contributor count, and deliberately omits package dependency graphs for now. A ML classifier is tried and fails, a hand-tuned composite separates a 150-project expert list better, and a feedback loop and dependency expansion remain planned.
AI-written summary · about
chapters (10)
- 0:00Defining criticality in open source
- 1:03Criticality scoring challenges
- 3:59Limitations of OpenSSF score
- 12:46Open discussion on criticality
- 20:15Dependency-based risk assessment
- 26:14Corporate responsibility in OSS
- 31:50Funding critical projects
- 36:01Tooling and community improvements
- 40:29Industry dependency patterns
- 42:00Closing remarks
related talks
41mAnalyzing The Projects We All Depend On - With LFX Insights
29mAnalyzing The Projects We All Depend On - With LFX Insights
31mLFX Insights: Understand The Projects You Rely On
22mKeynote: Opening Remarks
25mHow do you trust your open source software?
42mAssessing the Risk of Open-source Components Using OpenSSF's Scorecard
44mSecuring Open Source Software - End-to-End, at Massive Scale, Together
27mHow Do You Trust Your Open Source Software?