The latest articles on DEV Community by sab0tajue (@sab0tajue). https://dev.to/sab0tajue https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F3934897%2Fae7de1f3-7438-439e-84e8-1fd12d956dee.png https://dev.to/sab0tajue en sab0tajue Sat, 16 May 2026 14:25:08 +0000 https://dev.to/sab0tajue/i-scraped-every-show-hn-post-from-may-2025-to-may-2026-that-crossed-200-points-and-ran-a-5303 https://dev.to/sab0tajue/i-scraped-every-show-hn-post-from-may-2025-to-may-2026-that-crossed-200-points-and-ran-a-5303 <h2> Top 15 Show HN posts of the year </h2> <div class="table-wrapper-paragraph"><table> <thead> <tr> <th>Rank</th> <th>Points</th> <th>Comments</th> <th>Title</th> </tr> </thead> <tbody> <tr> <td>1</td> <td>3346</td> <td>965</td> <td>Gemini Pro 3 imagines the HN front page 10 years from now</td> </tr> <tr> <td>2</td> <td>1557</td> <td>363</td> <td>Jmail – Google Suite for Epstein files</td> </tr> <tr> <td>3</td> <td>1539</td> <td>197</td> <td>I'm an airline pilot – I built interactive graphs/globes of my flights</td> </tr> <tr> <td>4</td> <td>1325</td> <td>241</td> <td>isometric.nyc – giant isometric pixel art map of NYC</td> </tr> <tr> <td>5</td> <td>1278</td> <td>209</td> <td>I built a synth for my daughter</td> </tr> <tr> <td>6</td> <td>1184</td> <td>333</td> <td>A store that generates products from anything you type in search</td> </tr> <tr> <td>7</td> <td>1145</td> <td>144</td> <td>I spent 6 years building a ridiculous wooden pixel display</td> </tr> <tr> <td>8</td> <td>1094</td> <td>144</td> <td>Term.everything – Run any GUI app in the terminal</td> </tr> <tr> <td>9</td> <td>1032</td> <td>323</td> <td>I recreated Windows XP as my portfolio</td> </tr> <tr> <td>10</td> <td>1030</td> <td>263</td> <td>Tinder but it's only pictures of my wife and I can only swipe right</td> </tr> <tr> <td>11</td> <td>1003</td> <td>361</td> <td>Kitten TTS – 25MB CPU-Only, Open-Source TTS Model</td> </tr> <tr> <td>12</td> <td>964</td> <td>187</td> <td>A game where you build a GPU</td> </tr> <tr> <td>13</td> <td>958</td> <td>495</td> <td>Ten years of running every day, visualized</td> </tr> <tr> <td>14</td> <td>935</td> <td>234</td> <td>Draw a fish and watch it swim with the others</td> </tr> <tr> <td>15</td> <td>915</td> <td>134</td> <td>I built a tiny LLM to demystify how language models work</td> </tr> </tbody> </table></div> <p>Almost all of them are personal projects from individual builders. No SaaS launches in the top 15. No corporate product reveals. Just hobbyists with a story.</p> <h2> github.com is the dominant domain on Show HN </h2> <div class="table-wrapper-paragraph"><table> <thead> <tr> <th>Domain</th> <th>Posts that crossed 200 pts</th> <th>Avg points</th> </tr> </thead> <tbody> <tr> <td><strong>github.com</strong></td> <td><strong>134</strong></td> <td>334</td> </tr> <tr> <td>huggingface.co</td> <td>2</td> <td>471</td> </tr> <tr> <td>gitlab.com</td> <td>2</td> <td>330</td> </tr> </tbody> </table></div> <p><strong>134 out of 334 successful Show HN posts pointed straight at a github.com URL — about 40%.</strong> No fancy landing page, no marketing site, just <code>README.md</code> doing the selling.</p> <p>If you are about to ship a Show HN, the data says you can absolutely point at the repo. A polished landing page will not save a weak idea, and a strong README will not be punished for being on github.com.</p> <h2> What were the top github.com Show HN's actually about? </h2> <ul> <li> <strong>Term.everything</strong> – run any GUI app in the terminal (1094 pts)</li> <li> <strong>Kitten TTS</strong> – 25MB CPU-only open-source TTS model (1003 pts)</li> <li> <strong>A tiny LLM to demystify how language models work</strong> (915 pts)</li> <li> <strong>Workout.cool</strong> – open-source fitness coaching platform (827 pts)</li> <li> <strong>Needle</strong> – distilling Gemini tool calling into a 26M model (751 pts)</li> <li> <strong>Unregistry</strong> – <code>docker push</code> directly to servers without a registry (726 pts)</li> <li> <strong>ChartGPU</strong> – WebGPU-powered charting library (670 pts)</li> <li> <strong>Whispering</strong> – open-source local-first dictation (591 pts)</li> <li> <strong>WhatCable</strong> – tiny menu bar app for inspecting USB-C cables (566 pts)</li> </ul> <p>The pattern is clear: small, single-purpose, often local-first, often open-source. Tools developers might actually use tomorrow.</p> <h2> Most-mentioned keywords in titles </h2> <div class="table-wrapper-paragraph"><table> <thead> <tr> <th>Keyword</th> <th>Posts</th> </tr> </thead> <tbody> <tr> <td>AI</td> <td>20</td> </tr> <tr> <td>open-source / open source</td> <td>22</td> </tr> <tr> <td>browser</td> <td>17</td> </tr> <tr> <td>LLM</td> <td>11</td> </tr> <tr> <td>Claude</td> <td>10</td> </tr> <tr> <td>Rust</td> <td>10</td> </tr> <tr> <td>macOS</td> <td>10</td> </tr> <tr> <td>agent</td> <td>8</td> </tr> <tr> <td>MCP</td> <td>3</td> </tr> </tbody> </table></div> <p>AI/LLM/Claude/agent show up in roughly 50 of the 334 top posts. The "open-source" framing is more popular than the platform-specific ones (macOS, Rust). The browser is having a moment, with 17 posts about browser-related projects.</p> <h2> Aggregates </h2> <ul> <li>334 Show HN posts crossed 200 points</li> <li>Total: 132,288 points and 44,998 comments</li> <li>325 unique authors (most made it to the leaderboard once)</li> <li>187 unique domains</li> <li>Median Engagement Score: 70 / 100</li> </ul> <h2> Reproduce on your own data </h2> <p>I packaged the analysis as an Apify Actor — search the entire HN archive by query, tags, or date range, or just capture the live front page.</p> <p><a href="https://apify.com/kremkov-stanislav/hackernews-insights" rel="noopener noreferrer">Hacker News Insights on Apify Store</a></p> <p>Source code (MIT): <a href="https://github.com/sab0tajue/hackernews-insights" rel="noopener noreferrer">github.com/sab0tajue/hackernews-insights</a>. Engagement Score formula is in <code>src/insights.py</code>, around 30 lines.</p> <p>Tell me what other slices you would like to see. Show HN of the last 3 months? Specific keyword cohorts? Drop a comment and I will run it.</p> <p>Related: I previously analyzed <a href="https://dev.to/sab0tajue/i-analyzed-200-popular-python-repos-12-of-them-have-a-bus-factor-of-1-fastapi-whisper-3mnq">200 popular Python repos on GitHub</a> and the <a href="https://dev.to/sab0tajue">top 100 PyPI packages for supply-chain risk</a>.</p> analytics data sideprojects webscraping sab0tajue Sat, 16 May 2026 14:10:20 +0000 https://dev.to/sab0tajue/top-100-pypi-packages-have-1502-open-advisories-i-scanned-them-35dd https://dev.to/sab0tajue/top-100-pypi-packages-have-1502-open-advisories-i-scanned-them-35dd <p>I built a small Apify Actor that joins PyPI, pypistats.org, Google deps.dev, and OSV.dev and rolls them into one row per package: download trends, dependency graph depth, release cadence, license, and <strong>known vulnerabilities</strong> with severity. Each package gets a transparent <strong>Risk Score 0 to 100</strong>.</p> <p>Then I ran it across <strong>101 of the most-downloaded Python packages</strong>. Aggregate result:</p> <ul> <li> <strong>1,502 open advisories</strong> across the set</li> <li> <strong>789</strong> of them are <strong>HIGH severity</strong> </li> <li>Combined <strong>51,110,969,391 downloads / month</strong> </li> <li> <strong>48 of 101</strong> packages have no explicit license field declared in their PyPI metadata</li> <li>Median Risk Score across the set: <strong>20 / 100</strong> </li> </ul> <p>Every Python project on the planet pulls a chunk of these into production. Below are the highlights.</p> <h2> Most HIGH severity advisories (open) </h2> <div class="table-wrapper-paragraph"><table> <thead> <tr> <th>Package</th> <th>Latest</th> <th>HIGH</th> <th>Open total</th> <th>Risk</th> </tr> </thead> <tbody> <tr> <td>tensorflow</td> <td>2.21.0</td> <td><strong>412</strong></td> <td>676</td> <td>50</td> </tr> <tr> <td>Django</td> <td>6.0.5</td> <td><strong>96</strong></td> <td>275</td> <td>60</td> </tr> <tr> <td>pillow</td> <td>12.2.0</td> <td><strong>59</strong></td> <td>118</td> <td>60</td> </tr> <tr> <td>langchain</td> <td>1.3.1</td> <td><strong>28</strong></td> <td>37</td> <td>50</td> </tr> <tr> <td>urllib3</td> <td>2.7.0</td> <td><strong>16</strong></td> <td>30</td> <td>70</td> </tr> <tr> <td>aiohttp</td> <td>3.13.5</td> <td><strong>16</strong></td> <td>41</td> <td>50</td> </tr> <tr> <td>transformers</td> <td>5.8.1</td> <td><strong>15</strong></td> <td>27</td> <td>55</td> </tr> <tr> <td>cryptography</td> <td>48.0.0</td> <td><strong>13</strong></td> <td>28</td> <td>70</td> </tr> <tr> <td>Scrapy</td> <td>2.15.2</td> <td><strong>11</strong></td> <td>18</td> <td>65</td> </tr> <tr> <td>pip</td> <td>26.1.1</td> <td><strong>9</strong></td> <td>18</td> <td>60</td> </tr> </tbody> </table></div> <p>A few are surprising. pip is everyone's bootstrap tool. cryptography is the one library you trust by name. Both ship with HIGH severity advisories that have not been resolved across all referenced versions.</p> <h2> Most open advisories regardless of severity </h2> <div class="table-wrapper-paragraph"><table> <thead> <tr> <th>Package</th> <th>Open advisories</th> <th>Downloads / month</th> </tr> </thead> <tbody> <tr> <td>tensorflow</td> <td>676</td> <td>22,248,213</td> </tr> <tr> <td>Django</td> <td>275</td> <td>48,919,109</td> </tr> <tr> <td>pillow</td> <td>118</td> <td>458,766,714</td> </tr> <tr> <td>aiohttp</td> <td>41</td> <td>568,817,528</td> </tr> <tr> <td>langchain</td> <td>37</td> <td>242,406,997</td> </tr> <tr> <td>urllib3</td> <td>30</td> <td>1,617,997,614</td> </tr> <tr> <td>cryptography</td> <td>28</td> <td>1,183,622,768</td> </tr> <tr> <td>Twisted</td> <td>27</td> <td>11,978,196</td> </tr> <tr> <td>transformers</td> <td>27</td> <td>146,255,058</td> </tr> <tr> <td>pip</td> <td>18</td> <td>663,706,472</td> </tr> </tbody> </table></div> <p>Note: an open advisory does not mean every version is broken. Most advisories are pinned to specific affected version ranges. The number is a measure of historical attack surface, not current exploitability. Still, it is a useful signal of how heavily a package has been audited and how active its threat model is.</p> <h2> Highest Risk Score (composite) </h2> <p>The Risk Score combines: open vulnerabilities, last-release age, license declared yes/no, source URL declared yes/no, total resolved transitive dependencies, and is dampened by very high download counts (many eyes assumption).</p> <div class="table-wrapper-paragraph"><table> <thead> <tr> <th>Package</th> <th>Risk</th> <th>Why</th> </tr> </thead> <tbody> <tr> <td>Jinja2</td> <td><strong>75</strong></td> <td>15 open vulns, last release 436d ago, no license field</td> </tr> <tr> <td>urllib3</td> <td><strong>70</strong></td> <td>30 vulns (16 HIGH), no license field</td> </tr> <tr> <td>numpy</td> <td><strong>70</strong></td> <td>16 vulns (7 HIGH), no license field</td> </tr> <tr> <td>cryptography</td> <td><strong>70</strong></td> <td>28 vulns (13 HIGH), no license field</td> </tr> <tr> <td>Scrapy</td> <td><strong>65</strong></td> <td>18 vulns, 36 transitive deps</td> </tr> <tr> <td>Django</td> <td><strong>60</strong></td> <td>275 advisories total</td> </tr> <tr> <td>pip</td> <td><strong>60</strong></td> <td>18 vulns, no license field</td> </tr> <tr> <td>pillow</td> <td><strong>60</strong></td> <td>118 advisories</td> </tr> <tr> <td>Flask</td> <td><strong>60</strong></td> <td>8 vulns, 8 deps</td> </tr> </tbody> </table></div> <p>The "no license field" issue keeps popping up. <strong>48 of 101 most-downloaded packages have no license field declared</strong> in their PyPI metadata. This does not mean the projects are unlicensed - almost all of them have a LICENSE file in the repository - but it does mean automated scanners and SBOM generators may flag them as license-unknown, which causes real procurement headaches at large orgs.</p> <h2> Stalest top packages </h2> <div class="table-wrapper-paragraph"><table> <thead> <tr> <th>Package</th> <th>Last release</th> <th>Open advisories</th> </tr> </thead> <tbody> <tr> <td>vine</td> <td>923 days ago</td> <td>0</td> </tr> <tr> <td>sniffio</td> <td>810 days ago</td> <td>0</td> </tr> <tr> <td>python-dateutil</td> <td>805 days ago</td> <td>0</td> </tr> <tr> <td>openpyxl</td> <td>686 days ago</td> <td>2</td> </tr> <tr> <td>webdriver-manager</td> <td>660 days ago</td> <td>0</td> </tr> <tr> <td>six</td> <td>527 days ago</td> <td>0</td> </tr> <tr> <td>Jinja2</td> <td>436 days ago</td> <td>15</td> </tr> <tr> <td>rsa</td> <td>395 days ago</td> <td>6</td> </tr> </tbody> </table></div> <p>Jinja2 going 436 days without a release while sitting on 15 open advisories is the standout. Some of the others are stable-by-design (six, sniffio) and a long gap is fine.</p> <h2> How to reproduce / run on your own list </h2> <p>I packaged the audit as an Apify Actor - paste your requirements.txt, get the analysis as a clean JSON dataset row per package.</p> <p><a href="https://apify.com/kremkov-stanislav/pypi-package-insights" rel="noopener noreferrer">PyPI Package Insights on Apify Store</a></p> <p>Source code (MIT): <a href="https://github.com/sab0tajue/pypi-package-insights" rel="noopener noreferrer">github.com/sab0tajue/pypi-package-insights</a>. The Risk Score formula is in src/insights.py, around 80 lines, intentionally legible - re-weigh it for your threat model.</p> <p>If you have a more interesting set of packages to score, drop a comment with the names and I will run it.</p> <p>Related: I did the same exercise for <a href="https://dev.to/sab0tajue/i-analyzed-200-popular-python-repos-12-of-them-have-a-bus-factor-of-1-fastapi-whisper-3mnq">200 popular Python repositories on GitHub</a> earlier.</p> python security opensource devops sab0tajue Sat, 16 May 2026 13:14:28 +0000 https://dev.to/sab0tajue/i-analyzed-200-popular-python-repos-12-of-them-have-a-bus-factor-of-1-fastapi-whisper-3mnd https://dev.to/sab0tajue/i-analyzed-200-popular-python-repos-12-of-them-have-a-bus-factor-of-1-fastapi-whisper-3mnd <h2> Bus factor = 1: hugely popular projects, single point of failure </h2> <p>A repo's <strong>bus factor</strong> is the smallest number of top contributors who together hold ≥50% of all contributions. A bus factor of 1 means: one person is the project. If they stop, momentum stalls.</p> <p>Out of 200 popular Python projects, <strong>41 have bus factor = 1</strong>. The most exposed:</p> <div class="table-wrapper-paragraph"><table> <thead> <tr> <th>Project</th> <th>Stars</th> <th>Maintainer holding 50%+</th> </tr> </thead> <tbody> <tr> <td>EbookFoundation/free-programming-books</td> <td>388,403</td> <td>@vhf</td> </tr> <tr> <td>donnemartin/system-design-primer</td> <td>348,823</td> <td>@donnemartin</td> </tr> <tr> <td>vinta/awesome-python</td> <td>297,915</td> <td>@vinta</td> </tr> <tr> <td>AUTOMATIC1111/stable-diffusion-webui</td> <td>163,078</td> <td>@AUTOMATIC1111</td> </tr> <tr> <td>521xueweihan/HelloGitHub</td> <td>157,120</td> <td>@521xueweihan</td> </tr> <tr> <td>open-webui/open-webui</td> <td>137,303</td> <td>@tjbck</td> </tr> <tr> <td>Comfy-Org/ComfyUI</td> <td>113,135</td> <td>@comfyanonymous</td> </tr> <tr> <td>Shubhamsaboo/awesome-llm-apps</td> <td>110,589</td> <td>@Shubhamsaboo</td> </tr> <tr> <td>openai/whisper</td> <td>99,579</td> <td>@jongwook</td> </tr> <tr> <td>fastapi/fastapi</td> <td>98,245</td> <td><a class="mentioned-user" href="https://dev.to/tiangolo">@tiangolo</a></td> </tr> </tbody> </table></div> <p>Awesome-lists owning their bus factor is fine. But <strong>FastAPI, ComfyUI, Whisper, open-webui</strong> are critical infrastructure for a lot of people. Worth keeping in mind when you ship them in production.</p> <h2> "Active-looking" but actually dormant </h2> <p>These are not archived, they look maintained on the surface, yet nobody pushed a commit in the last 4 weeks:</p> <ul> <li> <strong>donnemartin/system-design-primer</strong> — 348k stars, last push 57d ago</li> <li> <strong>TheAlgorithms/Python</strong> — 221k stars, no commits in 4w</li> <li> <strong>AUTOMATIC1111/stable-diffusion-webui</strong> — 163k stars, last push 75d ago</li> <li> <strong>ytdl-org/youtube-dl</strong> — 140k stars, last push 85d ago</li> <li> <strong>openai/whisper</strong> — 99k stars, last push 30d ago</li> <li> <strong>3b1b/manim</strong> — 86k stars, last push 27d ago</li> </ul> <p>Some are by design (curated lists, finished tools). Others are slowly going stale.</p> <h2> Release cadence extremes </h2> <p><strong>Shipping fastest among popular projects:</strong></p> <div class="table-wrapper-paragraph"><table> <thead> <tr> <th>Project</th> <th>Avg gap between releases</th> <th>Stars</th> </tr> </thead> <tbody> <tr> <td>FoundationAgents/OpenManus</td> <td>0 days</td> <td>56,279</td> </tr> <tr> <td>PostHog/posthog</td> <td>0.2 days</td> <td>34,515</td> </tr> <tr> <td>gradio-app/gradio</td> <td>0.3 days</td> <td>42,600</td> </tr> <tr> <td>langchain-ai/langchain</td> <td>0.4 days</td> <td>136,866</td> </tr> <tr> <td>langchain-ai/langgraph</td> <td>0.4 days</td> <td>32,160</td> </tr> </tbody> </table></div> <p><strong>Slowest cadence at 5k+ stars:</strong></p> <div class="table-wrapper-paragraph"><table> <thead> <tr> <th>Project</th> <th>Avg gap</th> <th>Stars</th> </tr> </thead> <tbody> <tr> <td>trailofbits/algo</td> <td>815 days</td> <td>30,229</td> </tr> <tr> <td>satwikkansal/wtfpython</td> <td>698 days</td> <td>36,933</td> </tr> <tr> <td>deepfakes/faceswap</td> <td>623 days</td> <td>55,237</td> </tr> <tr> <td>swisskyrepo/PayloadsAllTheThings</td> <td>552 days</td> <td>77,735</td> </tr> <tr> <td>sherlock-project/sherlock</td> <td>434 days</td> <td>83,392</td> </tr> </tbody> </table></div> <p>A long gap is not automatically bad — finished tools, security playbooks, and content collections do not need weekly releases.</p> <h2> What 5000+ star Python projects are about </h2> <p>Top topics across the 200 repos:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code>python 92 ai 36 llm 34 deep-learning 21 machine-learning 20 pytorch 18 hacktoberfest 17 openai 17 chatgpt 17 rag 15 agents 14 ai-agents 13 cli 11 data-science 11 gpt 10 </code></pre> </div> <p>The Python OSS leaderboard in 2026 is overwhelmingly an AI agents / RAG / LLM-app leaderboard.</p> <h2> Aggregates </h2> <ul> <li>Total stars across the 200 repos: <strong>12,498,901</strong> </li> <li>Total forks: <strong>1,981,076</strong> </li> <li>Median Health Score: <strong>91 / 100</strong> </li> <li>With explicit OSS license: <strong>188 / 200</strong> (12 repos still have no license — risky to depend on those)</li> </ul> <h2> How to reproduce / explore your own list </h2> <p>I packaged the analysis as a one-shot Apify Actor — you give it a search query (or a list of <code>owner/repo</code>) and a free GitHub token, you get one row per repo with all the metrics above plus a transparent breakdown of how the Health Score is computed.</p> <p><a href="https://apify.com/kremkov-stanislav/github-repo-insights" rel="noopener noreferrer">GitHub Repository Insights on Apify Store</a></p> <p>Free trial, then $0.005 per analyzed repo. You can also clone the input from this post (<code>language: Python, minStars: 5000, pushedSince: 2025-12-01, maxResults: 200</code>) and re-run it against any other language or topic.</p> <p>If you find more interesting patterns, drop them in the comments — I am curious what your stack looks like.</p>