DEV Community

Cover image for Open Source Scams
Thomas Hansen
Thomas Hansen

Posted on • Updated on

Open Source Scams

Look carefully at the image for this article. Did you see anything "funny" about it? Let me enlighten you.

What you're looking at is an Open Source project. They're worth 1.2 billion US dollars according to their latest VC evaluation. Specifically you're looking at the history of their "Star gazers" according to GitHub. They were able to get a couple of hundreds of millions in VC funding from tier one VC funds in Silicon Valley some few years back ago.

Initially you can see organic growth. Then somewhere in early 2021 they got some traction, probably because of attention related to their VC funding, alternatively because of a major release going a little bit viral somewhere.

Afterwards you see it flattening out more, but still having some "hickups" here and there over the next 2 years, until December of 2022, at which point the curve goes completely "flat". Flat here implies it goes into a 100% perfectly straight line.

What you're looking at is what scientists will refer to as "a statistical anomaly impossible to explain using natural phenomenas". Such anomalies was the reason why Bernie Madoff was suspected of running a Ponzi scheme. His numbers were simply too good to believe.

Anomalies such as these simply don't occur in "natural systems" because of the laws of entropy prohibiting nature from creating such straight lines. Don't believe me, go find something resembling that line in nature.

Their line should be moving more like a "rugged line" with ups and down over time. Below I have emphasised the largest anomaly in the graph ...

The anomaly

Basically, since the end of 2022 they probably didn't get more than 1% organic likes on their GitHub project!

They bought GitHub Accounts

I tried to write about this a couple of years ago, the exact same company, but I didn't understand why so many of their "Star gazers" were mature GitHub accounts back then - So I started questioning myself, not 100% sure if I was right.

Yesterday I understood how they do it. To understand how they did it look carefully at the following screenshot from an E-Commerce website ...

Buy GitHub usernames

Notice how they're even selling "mature GitHub accounts"? Implying accounts older than one year, with actual content and activity?

Interestingly, their AI chatbot is a Shopify chatbot, so they're probably running their little scam as a Shopify website ... ðŸĪŠ

Got scam ideas? No problem bro, we at Shopify will help you sell it 😂

The Open Source VC Hoax

I don't know where the above merchant is getting these GitHub usernames. If I should guess, it's probably a combination of purchasing GitHub accounts from students, combined with having their click farm employees registering new accounts, for then to store these in "their aging vault" for some months before they're putting these out for sale.

They're also selling Gmail accounts, even aged Gmail accounts, so they've obviously got no shortage of handles you can buy to artificially inflate your open source project with fake likes. The reason anyone would do this is two folded.

  1. It gives justification for their evaluation, since VC firms and others will count star gazers, before evaluating the company
  2. It creates social proof, making others believing in that the platform must be valuable and good, since so many users have been liking it

Basically, it's a hoax! A good old fashion scam

The name of the company is Supabase, but they're not the only company doing this. If I'd guess I say probably 80 to 98 percent of every single VC funded company out there are using similar tactics to artificially inflate their evaluation.

There are even entire libraries written about such mechanisms, most of these are using words such as Pyramid scheme or Ponzi scheme to explain what's going on.

You will find the same mechanisms at every single social game in existence out there. Luckily for those applying such tactics, few are smart enough to smell them out, and even fewer are willing to publicly write about them - Such as me.

To understand the price we collectively pay for such scams, I want you to carefully read the entire article below.

... then come tell me how this is just some "innocent gaming hustling some few bucks out of rich investors" ...

The price for your Soul

I did some math on the above merchant's offers, and to purchase 68,000 accounts such as Supabase probably did, would cost you somewhere between $70,000 and $1.2 million, depending upon how many mature accounts you'd want.

Supabase got some 100 million in VC funding in total, implying they spent less than 0.5% of their liquidity on purchasing their likes. For a CFO and a CMO strategising to figure out how to grow their company, this is practically "free marketing", sustaining the illusion of a popular project worth billions of dollars, allowing them to milk their investors for even more money, to buy whatever it is they want to buy for other peoples' money ...

However, once money is involved, it's still security fraud - Especially once institutionalised investors are involved. The brilliance of the scam is that the VC firm will never publicly admit they were taken for a ride, it's simply too embarrassing for them, so Supabase probably got away 100% clean ...

The irony ... 😕

Supabase's CEO once patronised me by saying; "Your system is really good at sending emails" - Well, I wouldn't expect anything more from somebody who can only deliver fake value based upon Ponzi schemes, created to dupe money from investors, by gaming the world ...

... maybe I should send his investors some emails ...? 😉

Conclusion

Since late 2022, less than 1% of Supabase's GitHub star gazers are actually real living human being, the rest are likes they've purchased. In the period before that, starting from 2021, probably 95% or more of their likes are fake.

Any mathematician can verify that what I tell you is the truth. It is simply statistically impossible for nature to create such a smooth line in a natural system ...

This implies that when Supabase is telling you "We've installed 1 million databases", you would be wise removing at least 2 zeros from their numbers, implying they've probably not got more than some 3,000 to 4,000 actual likes, and probably somewhere around 10,000 to 100,000 real legitimate users.

The above should put their evaluation down by at least 1 to 3 zeros, implying instead of being worth 1 billion US dollars, their real evaluation is rather somewhere between 10 million dollars to 100 million dollars somewhere ...

A Healthy GitHub Project

Edit - Below is how a healthy GitHub project should look like. This project obviously has exclusively organic Stargazers.

Healthy GitHub project

The straight line you find in projects such as Supabase, and also MongoDB for that matter, is simply not possible to explain using any known natural phenomenas.

Edit - "That feeling" when you know somebody is really, really, really angry at you ... 😂

Chatbot

Edit 2 - A follow up article about Supabase versus Magic to explain what I really feel about it ...

Top comments (6)

Collapse
 
awalias profile image
awalias

Hi Thomas! Supabase co-founder here - can confirm we don't and have never paid for github stars. If you look at other repos over 40k stars on star-history you'll see that they stop tracking detailed data points above 40,000 which explains the strange behavior of the graphs once the line goes above 40k on the y axis.

Image description

Collapse
 
polterguy profile image
Thomas Hansen • Edited

OK, but how do you explain FreeCodeCamp's graph being bent while yours is 100% straight? Even React's graph curves, above 300K likes too may I add. React's graph also has "bumps" in it. Yours is 100% straight. This can only be explained by having the exact same amount of Stargazers liking the repo every single day, which of course is a "statistical anomaly" ...

But thx for commenting. Sporty actually, but you could have answered me before this article went viral on Twitter ;)

But I see your point about "missing data points", as in no dots above 40K ...

I took a couple of other screenshots. One from my own project.

Magic's GitHub stars

This is obviously organic growth ...
And may I add, every single commit in 2024 is "strange" too since the project has been 100% completely useless for 6 months now - Which begs the question; "Who the fÃļkk is liking this sjit?"

Another from Hasura, which arguably is more similar to what you do ...

Hasura

... although I have my "suspicions" about Hasura too may I add. Even ignoring everything above 40K, yours seems to be "suspiciously straight". I realise with larger numbers extrapolations kicks in, which you can see in the difference between Magic and Hasura, due to more data, and also comparing to React.

However, comparing your Stargazers with for instance MongoDB (which I also have some "suspicions" about may I add), it becomes interesting. Especially considering MongoDB has been around for more than a decade, they're one of the top 3 most popular document-based database systems in the world, and they've got 1/3 of your upvotes.

Seeing a project like .Net Framework having 15K stars can to some extent make sense, even though 30% of all developers world wide are using it - Since Microsoft doesn't really give a sjit, and never have encouraged users to like their stuff on GitHub to the extent you and others have.

However, MongoDB has been marketed as an Open Source database for more than a decade. Practically "half the internet" runs on it, and they've got 1/3 of your stars. I would suspect Mongo's user base being easily 10x your user base.

I know for a fact that people are starring my Magic repo, and have been for the last 6 months, which doesn't make any sense what so ever, since the project hasn't even been possible to download and compile for 6 months - Implying at least 100 users like it for "other reasons" than that it gave them something ...

Excuse me for asking, but how do you get stars ...?

Simply answering "people like it" won't cut it, sorry - It's simply not possible. If that was the case, MongoDB would have 500K, at least! And .Net Core would have 1,500K, easily!

And, while we're at it, all graphs except yours flattens out over time, including your own examples (except MogoDB), which is just natural because after all there's a finite amount of devs in the world, and a small fraction of these likes GitHub repos ...

  • Hasura curves
  • React curves
  • Everybody else's graphs curves
  • Except yours and MongoDB's that goes 100% straight "to heaven" ...

And, while we're at it, I assume a lot of your evaluation is based upon your user base, in combination with your IP - Anything else would be stupid. Ignoring my "user base questions", your core project is based upon (another) open source lib named PostgREST, where one single developer is responsible for 40% of its code, and another guy is responsible for 40% of the rest of the code - According to other GitHub statistics.

Implying, according to the above math, two devs could arguably replace 80% of your core engine in a handful of years, so the IP parts is obviously not that interesting ...

Resulting in that your company is basically 80% two devs ...

What are you paying these two devs ...? 😂

Facts are, you're not a company, you're two devs, with a 50+ strong marketing team. I would know, because I'm a solo dev, with 10,000+ commits the last 5 years, without a marketing team 😜

Which begs the question; WTF are your VC guys paying for ...? ðŸ˜ą

Collapse
 
bdougieyo profile image
Brian Douglas

I am working on a product that captures data from GitHub. We use Supabase for this app and I can confirm Supabase links to star their repo in the header of the site. This is not the only way they gain validation, but my take is you are focusing on the wrong thing. Stars are not a metric of success but rather a symptom.

But for the sake of entertaining the question of "why no curve." Supabase consistently hosts a launch week every 3 months. This a time when they build awareness for their open source product consistently. This also explains why no big curve. They are simply consistently showing up and not buying hype. There are several VC backed companies that your argument would work on, but I am afraid Supabase is not the one.

dev.to/opensauced/growth-hacking-k...

I think the blog post I linked compliments your post, but grounds in data differently than you did here. FWIW I starred your repo. Happy hacking

Thread Thread
 
polterguy profile image
Thomas Hansen • Edited

Interesting fact time; The article you're linking to says GitHub has 100 million users. There are a maximum of 28 million software developers in the world today. Who are these other guys ...?

statista.com/statistics/627312/wor...

However, when that's said, Coca Cola is a bajillion times more popular than orange juice. Any sane human being wouldn't touch coke, but probably drinks lots of orange juice, for reasons that should be obvious.

Interesting comment and thx for intelligent feedback, but you might want to read my other articles about Supabase too before diving in too deep. You can follow the bread crumbs to find them ...

There is something fundamentally wrong with our ecosystem, and I feel Supabase exemplifies it - Maybe not the worst offender, and for all I know, they might be seriously trying - But the (software development) world would literally be a better place without them, even ignoring this particular articles about them ...

... for the same reasons the world would be better off without both Coca Cola and McDonalds ... :/

TL;DR -

Collapse
 
dyfet profile image
David Sugar

This made me think of something else, the recent hack announcing 10 billion unique user names and passwords have been hacked and are up for sale now. I wonder how many of those are from some click-farm's hacked server.... are we already at the point there are more bots than people?

Collapse
 
polterguy profile image
Thomas Hansen

Well, according to science into the subject, there are 30 million developers. So how come there are 90 million GitHub accounts? Maybe some of these can be attributed to PMs and designers, but not 60 million ...