Hacker News Reader

Comment by ufmace | Hacker News Reader

Good news for the Ruby ecosystem, but I'd also like to get a handle on exactly how many of the most popular gems have "over 180 million total downloads".

View on HN

Many: https://rubygems.org/stats

You can also get database dumps here to dig further: https://rubygems.org/pages/data

Approximately 100 gems, representing about a third of downloads.

The original plan was to target based on download rankings, but these fluctuate, so in theory gems could be added and then removed from the list. A count of downloads can only go up.

Were download rankings combined with one-way "membership" considered? (One-way "membership": once a gem/user qualifies based on recent downloads, they're permanently required in perpetuity.)

This seems to be like it would mitigate the on/off problem of using a variable metric while also being biased to the currently relevant gems/users.

IIRC we figured it would be more confusing than helpful.

That makes a lot of sense, actually.

Remember that 'downloads' is only half the metric that matters... Really 'users' is what matters, but a single download could lead to the code being used by a large platform provider and that code handling the private data of 1 Billion users.

So, you really want every possible assurance that that code does what it says. And MFA is a good start for that.

It's true that download count is a coarse metric, but it's the one we chose on this occasion to start with a manageably-sized cohort.

As it happens I gave a talk[0] about how to rank projects according to their risk. A surprisingly difficult topic.

[0] https://www.youtube.com/watch?v=T_Lrb2rYLps

That is what happens if you have CI systems that doesn't cache sufficiently aggressive.

Reply on news.ycombinator.com