Open Source Success Learnings from 1 Billion Downloads
summary
Scarf gateway sits between users and registries and collects metadata via redirect links, SDKs like scarfjs and registry integrations under Maven Central, totaling 2.2 trillion downloads across ~100,000 packages and 350 million origin IDs. Analysis shows heavy concentration — top 1% gets ~95% of traffic — 2 million unique companies and 96% of the Fortune 500 appear, AWS dominates cloud pulls, VPNs are <0.1%, average downloads:uniques runs ~100:1 (often 1,000:1), and 80% of container pulls use the latest tag.
AI-written summary · about
chapters (15)
- 0:00Open source success intro
- 1:28Scarf’s open source data
- 7:05Global open source usage
- 10:15Business adoption of OSS
- 12:01Cloud and registry insights
- 13:49Container registry markets
- 16:42Power laws in popularity
- 18:26Download numbers misleading
- 23:21Automated download inflation
- 25:03User agents importance
- 27:11Security risks of unpinned deps
- 28:36OSS adoption funnel model
- 30:03Churn rates AI vs DB
- 31:26Why OSS sustainability matters
- 33:55Q&A on supply chain security
related talks
30m10 Billion Downloads: Insights and Trends in Open Source
31mOpen Source Supply Chain Threat Landscape - A Moving Target
35mUnpacking Open Source Security in Public Repos & Registries
49mTrustworthy Open Source: The Consequences of Success
25mTrusting Your Open-Source Software Supplier
45mPanel Discussion: Managing Open Source...
32mEasier, Faster, and Safer Open Source Consumption Governance
48mAn Introduction to the Newest Addition to the OWASP Top 10