50 out of 413 Companies that use my libraries

But if you want to know more specific info, say "which of my libraries gets the most downloads," they point you to a separate service called "Scarf."

And wow, that is neat. A lot of people use my repackaged guava (which whatever), but actually I get quite a few downloads on my JSON library. Nowhere near Jackson, but I choose to be happy about it. Really wish I could see the rest though.

And it makes sense that most of my users are in the US, but I am taken aback by how much of the globe I've touched.

A bit of a bummer that I only get to see the last 3 months, I wonder if I hit everywhere at least once.

But hey what the fuck is this?

So okay clearly behind the scenes they have some way to guess at which companies are the ones initiating a download for a library. Probably no more complicated than having some known IP addresses of them. That isn't what shocks me.

What shocks me is both that they gate this information and the price they demand for access.

So as whatever user tier I am I get "50 free unlock credits". Meaning of the large corporations that use the libraries I publish I can see exactly 50.

To get 250 unlocks, which isn't even the whole list for me, I would have to pay them $1350 a month.

Well, not really. That is just what they show as the default. I can tune the "runs" number down to 1 and the "company unlocks" to exactly 413 and then it is only $1076.60 a month.

And I could go into all the other pricing options, but I think you get the picture. That's more than a car payment and only a little less than a Github Copilot subscription.

Clearly they are able to gatekeep it. Sonatype sold them IPs of downloads and they have a dataset mapping IPs to companies. Neither of those are public so they get to put a price on it.

But the only reason people would pay a price is that the information has value. If an author knows exactly who is consuming their open source libraries that gives them leverage. They can go to these companies and say "Hey, I am in your supply chain."

If you have been following me the last few months you'll know I have been working on a repository scheme of my own. Making it such that information like "Company A depends on David Smith of Lansing Michigan" is not gatekept has now moved way up my priorities list.

Because fuck this, fuck Scarf.

<- Index