Weekend at Bernie's II
Comments on “Weekend at Bernie's II”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Andrew Nesbitt re-ran his May classification of ecosyste.ms critical repos: 421 that were dead, dormant or unknown are active again, though the overall split moved under two points. Ownership rarely changed; a new person took over in six cases. AI-disclosed commits rose from 3.3% to 7.9% of human commits in revived repos, mostly from each repo's top committer. Advisories from previously inactive repos waited a median 38 days for GitHub's reviewed database, versus 11 for active ones, delaying Dependabot alerts.
Why it ranked
No. 3 of 51 with a score of 0.75. The panel rated it highest on new information (0.93) and substantiated (0.91), lowest on significance (0.69).
- AI judgeJudge 2claude-haiku-5-5
- Substantive, well-sourced longitudinal study of dependency maintenance and security advisory lag in critical open-source packages, with AI agent usage data; highly relevant to builders, though it is a follow-up piece.
- AI judgeJudge 3gpt-5.6-luna
- A data-rich longitudinal analysis of critical dependency maintenance, AI-assisted revival, vulnerability disclosure delays, unanswered reports, and ecosystem risk. It provides original measurements and concrete operational implications, with modest interpretive claims.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.75total under rubric v2.3
- Significance0.69
- Reader interest0.84
- Audience breadth0.76
- Practical relevance0.79
- Substantiated0.91
- Technical depth0.72
- New information0.93
- Counts against: Promotional0.03
- Counts against: Overclaim0.21
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.69 | 0.55 | 0.82 | 0.69 | 0.27 | +0.24 | +0.165 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.77 | 0.82 | 0.93 | 0.84 | 0.16 | +0.26 | +0.218 |
| Audience breadthHow many people who build technology does it concern? | 0.80 | 0.70 | 0.78 | 0.76 | 0.10 | +0.13 | +0.099 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.71 | 0.80 | 0.86 | 0.79 | 0.15 | +0.22 | +0.174 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.93 | 0.85 | 0.94 | 0.91 | 0.09 | +0.05 | +0.045 |
| Technical depthHow technically substantive is it? | 0.82 | 0.60 | 0.73 | 0.72 | 0.22 | +0.05 | +0.036 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.92 | 0.90 | 0.97 | 0.93 | 0.07 | +0.05 | +0.047 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.04 | 0.03 | 0.03 | 0.03 | 0.01 | −0.19 | −0.006 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.36 | 0.20 | 0.08 | 0.21 | 0.28 | −0.11 | −0.023 |
| Sum of contributions | +0.754 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.754 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-11-08/3/"><img src="https://rubric.hrih.si/badge/2026-11-08/3.svg" alt="Ranked #3 on Rubric, 8 Nov 2026" width="231" height="28"></a>Claim check
Claim check: 2 matches source · 6 no source given. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
No source givenNumber
Between May and November, 421 critical repos that were dead, dormant or unknown became active again.
The article gives no link or citation for it.
The article says “421 of the critical repos that were dead, dormant or unknown in May are active again”
The source says No source to compare with.
No source givenNumber
Registry maintainer lists changed on the packages of only 16 of the 421 revived repos, and only six involved a new person taking on the work.
The article gives no link or citation for it.
The article says “Registry maintainer lists changed on the packages of only 16 of the 421 revived repos”
The source says No source to compare with.
No source givenNumber
In the six months since May, 7.9% of human-authored commits in the revived repos carried an AI disclosure, across 95 repos and 778 commits, versus 3.3% across 22 repos in the prior six months.
The article gives no link or citation for it.
The article says “In the six months since, it was 7.9% over 95 repos, 778 commits in all, and 566 of them came from each repo’s own top committer”
The source says No source to compare with.
Matches sourceQuote
GitHub reported private vulnerability reports rose from about 550 a week in January to more than 3,000 a week for most of May, and said it had not consistently met its internal publication goals since mid-April.
The cited source says the same thing.
The article says “Private vulnerability reports went from about 550 a week in January to more than 3,000 a week for most of May”
The source says “Private vulnerability reports across the platform increased from ~550/week in January to more than 3,000/week for most of May”
Source cited by the article: github.blog/security/supply-chain-security/inside-the-advisory-database-and-what-happens-when-vulnerability-volume-breaks-records
No source givenNumber
Across 1,011 advisories since May, the median wait from maintainer advisory to the reviewed database was 11 days for repos active in May and 38 days for repos that were dormant, dead or unknown.
The article gives no link or citation for it.
The article says “The median wait from there to the reviewed database was 11 days for repos that were active in May and 38 days for repos that were dormant, dead or unknown”
The source says No source to compare with.
No source givenCausal conclusion
The author concludes that agents made the backlog on finished-but-neglected libraries small enough to clear, with maintainers who knew the code best placed to check the agent's output.
The article gives no link or citation for it.
The article says “the agents made the backlog on a finished-but-neglected library small enough to clear, and the maintainers who already knew the code were the ones best placed to check what the…”
The source says No source to compare with.
Matches sourceQuote
The fribidi 1.0.18 release lists security and robustness fixes found by Anthropic's OSS Scanner, including an out-of-bounds write.
The cited source says the same thing.
The article says “Security and robustness fixes found by an automated scan (Anthropic’s OSS Scanner”
The source says “Security and robustness fixes found by an automated scan (Anthropic's OSS Scanner”
Source cited by the article: github.com/fribidi/fribidi/releases/tag/v1.0.18
No source givenNumber
Advisories with no patched version rose from 110 in May to 133 in November.
The article gives no link or citation for it.
The article says “advisories with no patched version 110 133 +23”
The source says No source to compare with.
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 2 pts, not on front page
Recorded for context only, checked 8 Nov 2026, 05:46 UTC. It played no part in the ranking.