Conversation

Notices

1. Embed this notice
   Josh Bressers (joshbressers@infosec.exchange)'s status on Monday, 09-Dec-2024 08:43:21 JST Josh Bressers

   I'm doing some data analysis on open source dependency relationships this evening (quite the exciting Sunday night!)

   There are more Ruby GEMS with 5 dependents (the number of packages that depend on this one) than there are with 2

   No other open source ecosystem has this pattern

   • Embed this notice
     🌱 Ligniform :donor:​ (ligniform@infosec.exchange)'s status on Monday, 09-Dec-2024 08:49:21 JST 🌱 Ligniform :donor:​

     in reply to

     @joshbressers I'd love to see the spiderweb-like graph of dependencies

   • Embed this notice
     Josh Bressers (joshbressers@infosec.exchange)'s status on Monday, 09-Dec-2024 08:53:41 JST Josh Bressers

     in reply to

     • 🌱 Ligniform :donor:​

     @ligniform That's the ultimate goal

     One of the wild problems is the hilarious number of things that have 0 dependents (it's like 80% of open source packages)

   • Embed this notice
     🌱 Ligniform :donor:​ (ligniform@infosec.exchange)'s status on Monday, 09-Dec-2024 09:14:15 JST 🌱 Ligniform :donor:​

     in reply to

     @joshbressers 80% are just sitting on the outside minding their own business. The rest are all connected to each other in the craziest ways. Hell yeah.

   • Embed this notice
     Josh Bressers (joshbressers@infosec.exchange)'s status on Monday, 09-Dec-2024 09:16:18 JST Josh Bressers

     in reply to

     • 🌱 Ligniform :donor:​

     @ligniform So most of that 80% have dependencies

     One thing I'm very interested in are the lone wolf packages, that depend on nothing and nothing depends on them

   • Embed this notice
     🌱 Ligniform :donor:​ (ligniform@infosec.exchange)'s status on Monday, 09-Dec-2024 09:29:02 JST 🌱 Ligniform :donor:​

     in reply to

     @joshbressers oh I see.

     I'm interested to see this, visualizing data does scratch an itch 😅