Quantifying Nebraska

on YouTube ↗12m

" summary

Uses cargo.lock to extract repo URLs via the crates.io API and finds 494 Rust dependencies plus 1,999 JavaScript dependencies, then scores repos by measurable maintenance signals: open issues and response time, PR volume and review latency, number of maintainers, author affiliations, and whether sponsorships or Tidelift support exist. Proposes lightweight actions: money, sponsored contributor time, triage or docs work, and plans to publish the data and scoring code soon.

AI-written summary · about

" chapters (10)

1. 0:00Introduction
2. 1:02Beyond security CVEs
3. 2:47Mapping dependencies
4. 3:49Maintainer support needs
5. 5:37Human factors in sustainability
6. 7:21Dependency health scoring
7. 8:25Project support examples
8. 9:27Helping maintainers
9. 10:49The importance of direct communication with maintainers
10. 11:09Conclusion

" related talks

• 26m"Quantifying Nebraska"Adam Harvey · PyCon AU 2024
• 50mCrate security in 2025Adam Harvey · Rust Nation UK 2025
• 05mQuantifying your reliance on Open Source softwareJamie Tanna · DevOpsDays London 2023
• 19mCan I trust that package?Colin S Gillespie · posit::conf(2025)
• 41mFinding LibRaska: The Open Source Library that Props up our InfrastructureJulia Ferraioli, Caleb Brown, Amir Montazery · OpenSSF Day 2022
• 37mHow to Serve Open Source Maintainers Without Annoying Them?Munawar Hafiz · SupplyChainSecurityCon @ Open Source Summit Japan 2023
• 10mLightning Talk: Scoring Dependencies to Detect “Weak Links” in your Open-source So...Ashish Bijlani · SupplyChainSecurityCon at Open Source Summit Europe 2022
• 40mDiscovering Emerging Open Source Communities Through...Hema Veeradhi, Oindrilla Chatterjee · OSPOCon @ Open Source Summit North America 2023