[bsuvc]

> I don't think I have ever used stars in making a decision to use a library and I don't understand why anyone would

I do it all the time, whenever there are competing libraries to choose among.

It's a heuristic that saves me time.

If one library has 1,000 stars and the other has 15, I'm going to default to the 1,000 stars.

I also look at download count and release frequency. Basically I don't want to use some obscure dependency for something critical.

[swiftcoder]

> If one library has 1,000 stars and the other has 15, I'm going to default to the 1,000 stars.

There are clearly inflection points where stars become useful, with "nobody has ever used this package" and "Meta/Alphabet pays to develop/maintain this package" on the two extremes.

I'm less sure what the signal says in-between those extremes. We have 2 packages, one has 5,000 stars, the other has 10,000 stars - what does this actually tell me, apart from how many times each has gone viral on HN?

[bigiain]

At the 10,000 star level, my worry is going to be how tempting a target it is for a supply chain attack. (Most likely via one of it's dependencies.)

[bonesss]

If the goals relate to maintenance and viability, we’re looking for a minimum threshold of implementation. Amazon and Microsoft have a lot of stars, both have ‘more than enough’ to care.

If the goals are marketing or targeting or mass-market appeal or hiring pools then those stars say something else.

[nradov]

And that's fine if you're just writing a toy program for personal use. But it's deeply problematic if you have to rely on that library for anything important. This type of lazy approach to the software bill-of-materials has gotten a lot of organizations into trouble with exploitable security flaws.

[godelski]

  > It's a heuristic that saves me time.

Sounds like it is wasting your time.

Just because you make a decision quicker doesn't mean you saved any time. It is good to save time, but not at the sake of quality. You spend more buying cheap boots, and they don't even keep your feet dry.

[matt_kantor]

> If one library has 1,000 stars and the other has 15, I'm going to default to the 1,000 stars.

Will you continue to do this after reading TFA?

[hnben]

<10 Stars is a strong signal, that a repo is not relevant to anyone except maybe the maintainer. This fact does not change even if other repos have bough 10.000 stars.

[matt_kantor]

I don't know how often this happens, but what about repositories that would "naturally" have <10 stars if not for buying them? Is the signal you're referring to still useful if it can be artificially silenced by spending some money?

[hartbook]

why would it be a strong signal? have you ever starred a project? I don't

[system2]

More stars = More followers = More people interested and contribute. Even with fake, there will be more people joining the project because they are duped. Still though it is going to get more attention.

[abustamam]

I will. I have other heuristics too, like there are plenty of starred libraries that are just hard to use or don't actually fit my use case. But if I choose the 1000 star one and it works easily, then cool. If it doesn't, I'll try the 15 star one. If it works, cool. If not, then I'll probably end up vibe coding my own thing.

[manquer]

Why not? Buying stars is also a positive signal on commitment.

i.e. if the maintainer is serious enough to buy stars, is not in theory likely to spend time /money in maintaining /improving the project also ?.

Presumably he wouldn't just want fake users but also real users, which is a signal than a just purely hobby project, that is vibe-coded on a whim over a weekend and abandoned?

[kylecazar]

It's a positive signal for fraud and willingness to deceive.

[justcool393]

> i.e. if the maintainer is serious enough to buy stars, is not in theory likely to spend time /money in maintaining /improving the project also ?.

i mean if maintainers clearly spend much more time and effort on fraud than actually improving the project, why should I at all believe they would, let alone trust their judgement with regards to other things such as technical choices for example

[LtWorf]

The problem is that you will mis-evaluate unknown projects that aim to be (or already are) VC funded.

[whatisthiseven]

> It's a heuristic that saves me time.

A bad one.

I listed many other useful heuristics. Do you not find value in them? Do you find stars more valuable than them?

Take a moment to consider stars as a useful metric may only be useful for packages created prior to ~2015 when they weren't such a strong vanity metric, and are already very well established. This is preconditioning you to think "stars can still sometimes be useful, because I took a look at Facebook's React GH and it has a quarter million stars".

Sure, it's useful for that. But you aren't going to evaluate if the "React" package is safe. You already trivially know it is.

You'll be evaluating packages like "left-pad". Or any number of packages involved in the latest round of supply chain attacks.

For that matter, VCs are the ones stars are being targeted at, and potential employers (something this article doesn't cover, but some potential hires do hope to leverage on their resume).

If you are a VC, or an employer, it is a negative metric. If you are a dev evaluating packages, it is a vacuous metric that either tells you what you already know, or would be better answered looking at literally anything else within that repo.

The article also called out how download count can be faked trivially. I admit I have relied upon this in the past by mistake. Release frequency I do use as one metric.

When I care about making decisions for a system that will ingest 50k-250k TPS or need to respond in sub-second timings (systems I have worked on multiple times), you can bet "looking at stars" is a useless metric.

For personal projects, it is equally useless.

I care about how many tutorials are online. And today, I care more about if there was enough textual artifacts for the LLMs to usefully build it into their memory and to search on. I care if their docs are good so I spend less tokens burning through their codebase for APIs. I care if they resolve issues in a timely manner. I care if they have meaningful releases and not just garbage nothings every week.

I didn't mean for this to sound like a rant. But seriously, I just can't imagine in any scenario where "I look at stars" as a useful metric. You want to add it to the list? Sure. That is fine. But it should not be a deciding factor. I have chosen libraries with less stars because it had better metrics on things I cared about, and it was the correct choice (I ended up needing to evaluate them both anyhow. But I had my preference from the start).

Choosing the wrong package will waste you so much more time. Spend the 5 minutes evaluating for stuff that is important to your project.

[strbean]

Having stars isn't a positive metric, it's more that not having stars is a disqualifier unless I want to use someones brand new toy.

My first scan of a GitHub repository is typically: check age of latest commit, check star count, check age of project. All of these things can be gamed, but this weeds out the majority of the noise when looking for a package to serve my needs. If the use case is serious, proper due diligence follows.

[oreally]

This behavior is similar from the time I played a very popular mmorpg - when people selected others for their groups, their criteria deferred to the candidate's analyzed gameplay records (their 'logs') on a website which boiled down to a number showing their damage dealt and the color of it's text.

There was nothing about going into the logs to see if they could do the game's mechanical challenges, minimizing their damage taken. It made for a worse environment yet the players couldn't stop themselves from using such criteria.

In short, humans are lazy and default to numbers and colors when given the chance. When others question them on it, they can have a default easy answer of being part of the herd of zebras to get out of trouble.

[doctorpangloss]

you're arguing with people who are fundamentally unempathetic. it's a lot of words spent on vamping about stars instead of contributing to stuff everyone actually uses, which hardly anyone does, which should tell you everything you need to know about the value of having open source users: most of them only care that something is free as in beer.

[bsuvc]

Are you suggesting that because I consider stars, I must be a freeloader?