The Metrics That Ate Our Values
I built my first open source project in 2019. It was terrible. But it got 847 stars in three months because I posted it to Product Hunt on a Tuesday and someone with 50k followers retweeted it. Those stars meant nothing. They still don't. And yet—I still think about that number sometimes when I'm alone.
This is the core problem with GitHub's star economy, except it's worse than you think. It's not just that people are gaming the system with bot accounts and fake engagement farms. The real issue is that we've collectively decided that a number in the top-right corner of a repository matters enough to cheat for it. When did that happen?
- Stars used to signal: people found this useful or interesting
- Then they became currency for developer reputation, job interviews, consulting rates, and whether VCs would even look at your startup
- Now they're just... counterfeit
- And I'm genuinely unsure if this changes anything about how we should evaluate projects, because honestly the system was already broken before the bots showed up
The detection mechanisms exist. GitHub can flag suspicious patterns. Automated systems can identify star-bombing campaigns. But here's what keeps me up: does it matter? If someone's project legitimately solves a problem, does it matter that it has 2,000 real stars or 5,000 fake ones mixed in? I want to say no. I don't actually believe that.
Why We Built This Problem Into Our DNA
GitHub made a choice in 2010 when they made the star count visible and prominent. It was a good choice for network effects. Terrible choice for human behavior. They created the perfect incentive structure for exactly the kind of fraud we're seeing now, and nobody could have predicted—actually, lots of people predicted it immediately, we just didn't care because the growth numbers looked good.
The real frustration here is that open source was supposed to be different. It was supposed to be merit-based, transparent, driven by actual contribution and actual code review. Turns out what we built instead was a vanity system with better optics. At least in finance everyone admitted they were playing for status and money. In open source we pretended we were playing for the mission while optimizing for metrics that measure neither mission nor merit.
I work with startups doing digital transformation. Every single one of them wants to know their GitHub star count before they pitch. Not their API response time. Not their test coverage. Not whether anyone's actually using the thing. The star count. It's 2024 and we're still making decisions based on a number that takes fifteen minutes to fabricate with a throwaway credit card.
The Uncomfortable Middle Ground
Here's where I lose the thread and I'm okay admitting it: I don't think the answer is to kill stars entirely. That would be throwing out something that genuinely helps discovery. New developers scrolling through GitHub need some signal about what's mature and what's abandoned. Stars provide that signal imperfectly, which is better than not providing it at all. Maybe. I think.
Alternatively we could weight stars by contributor diversity, merge frequency, issue resolution time—make it harder to game. But that just moves the gaming downstream. According to GitLab's 2023 DevSecOps report, projects with more diverse contributor bases did show better security outcomes, so maybe that's the metric we should care about anyway.
Or we could do what I actually think needs to happen: stop pretending GitHub metrics matter. Use them as a tea leaf reading, not a decision mechanism. Evaluate open source projects the way you'd evaluate anything else—by actually looking at the code, running it yourself, checking if it has maintenance, seeing if it solves your problem. Revolutionary idea.
But we won't do that. We're too busy looking at what other people are using to bother checking if we actually like it.
What Happens Next
GitHub will probably implement some fixes. The fake star ecosystem will adapt. New forms of reputation gaming will emerge on platforms we haven't thought of yet. And somewhere, someone will still ask me how many stars my project has before they read a single line of my code.
