4.5M Suspected Fake Stars in GitHub
Researchers have identified millions of suspected fake “stars” on GitHub, highlighting how easily this popularity metric can be bought or manipulated. Commenters argue that stars are a weak proxy for code quality or security—often used merely as bookmarks or marketing—and explore alternative signals such as commit activity, issue resolution, dependency usage, or webs of trust. The broader concern is that any visible metric tied to money, hiring, or VC interest will be gamed, so platforms need more robust, multi-factor reputation systems rather than relying on a single number.
Role and Meaning of GitHub Stars
- Many commenters say stars are essentially bookmarks: “I might want to look at this later,” not an endorsement of quality or even usage.
- Others treat star count as a rough popularity signal, e.g., when choosing between libraries (“10 stars vs 30k stars”).
- Several note that GitHub’s own docs present stars as a way to save repos, but an ecosystem has grown that treats them as clout, traction, or credibility.
Incentives and Star-Gaming
- Stars matter for CVs, perceived legitimacy, VC pitches, open-core traction, and funding; that creates strong incentives to buy or otherwise game them.
- Some see this as a classic prisoner’s dilemma: if gaming is allowed, not gaming becomes a disadvantage.
- Hackathon sponsorships that demand stars from participants and ads pushing repos are cited as manipulative, if not strictly fraudulent.
- One commenter notes the paper’s numbers: millions of suspected fake stars but far fewer unique accounts after de-duplication.
Usefulness of Stars as a Metric
- Many argue stars are a poor quality metric: trivially easy to click, heavily influenced by age, hype, and personality/brand.
- Others still find them useful as a first-pass filter or for sorting search results, especially when entering a new ecosystem.
- There’s skepticism that “N strangers clicked an icon” should ever be treated as a safety or security signal.
Alternative and Composite Signals
- Commonly suggested better indicators:
- Recent commit activity and total commits.
- Open vs. closed issues and PRs; issue resolution patterns.
- Number of contributors and dependency usage / reverse dependencies.
- Clone/download counts or imports (with caveats that these can also be gamed).
- Several propose multi-factor or third‑party “repo quality scores,” but doubt anyone would pay for such a service.
Detection, Defense, and Social/Trust Models
- Some think GitHub should detect and discount fake stars (e.g., only count “active developer” accounts), others argue every rule set is easily automated around.
- Web‑of‑trust ideas (prioritizing stars from people you follow or friends‑of‑friends) are discussed but criticized as gameable, low-signal, or misaligned with how developers actually use GitHub.
- Broader point: all metrics become targets (Goodhart’s law), so users must treat any single number with caution.