Open Source Scams
Tags: lowcode, security
Published: 2024-07-03 13:21:14

Look carefully at the image for this article. Did you see anything _"funny"_ about it? Let me enlighten you.

What you're looking at is an Open Source project. They're worth 1.2 billion US dollars according to their latest VC evaluation. Specifically you're looking at the history of their _"Star gazers"_ according to GitHub. They were able to get a couple of hundreds of millions in VC funding from tier one VC funds in Silicon Valley some few years back ago.

Initially you can see organic growth. Then somewhere in early 2021 they got some traction, probably because of attention related to their VC funding, alternatively because of a major release going a little bit viral somewhere.

Afterwards you see it flattening out more, but still having some _"hickups"_ here and there over the next 2 years, until December of 2022, at which point the curve goes completely _"flat"_. Flat here implies it goes into a 100% perfectly straight line.

What you're looking at is what scientists will refer to as _"a statistical anomaly impossible to explain using natural phenomenas"_. Such anomalies was the reason why Bernie Madoff was suspected of running a Ponzi scheme. His numbers were simply too good to believe.

Anomalies such as these simply don't occur in _"natural systems"_ because of the laws of entropy prohibiting nature from creating such straight lines. Don't believe me, go find something resembling that line in nature.

Their line _should_ be moving more like a _"rugged line"_ with ups and down over time. Below I have emphasised the largest anomaly in the graph ...

![The anomaly](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/oruydew47aeg907hwhwz.png)

Basically, since the end of 2022 _they probably didn't get more than 1% organic likes on their GitHub project_!

## They bought GitHub Accounts

I tried to write about this a couple of years ago, the exact same company, but I didn't understand why so many of their _"Star gazers"_ were mature GitHub accounts back then - So I started questioning myself, not 100% sure if I was right.

Yesterday I understood how they do it. To understand how they did it look carefully at the following screenshot from an E-Commerce website ...

![Buy GitHub usernames](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pplsryuvv29ae9vk7kx0.png)

Notice how they're even selling _"mature GitHub accounts"_? Implying accounts older than one year, with actual content and activity?

Interestingly, their AI chatbot is a Shopify chatbot, so they're probably running their little scam as a Shopify website ... 🤪

> Got scam ideas? No problem bro, we at Shopify will help you sell it 😂

## The Open Source VC Hoax

I don't know where the above merchant is getting these GitHub usernames. If I should guess, it's probably a combination of purchasing GitHub accounts from students, combined with having their click farm employees registering new accounts, for then to store these in _"their aging vault"_ for some months before they're putting these out for sale.

They're also selling Gmail accounts, even aged Gmail accounts, so they've obviously got no shortage of handles you can buy to artificially inflate your open source project with fake likes. The reason anyone would do this is two folded.

1. It gives justification for their evaluation, since VC firms and others will count star gazers, before evaluating the company
2. It creates social proof, making others believing in that the platform must be valuable and good, since so many users have been liking it

> Basically, it's a hoax! A good old fashion scam

The name of the company is [Supabase](https://supabase.com), but they're not the only company doing this. If I'd guess I say probably 80 to 98 percent of every single VC funded company out there are using similar tactics to artificially inflate their evaluation.

There are even entire libraries written about such mechanisms, most of these are using words such as Pyramid scheme or Ponzi scheme to explain what's going on.

You will find the same mechanisms at _every single social game_ in existence out there. Luckily for those applying such tactics, few are smart enough to smell them out, and even fewer are willing to publicly write about them - Such as me.

To understand the price we collectively pay for such scams, I want you to carefully read the entire article below.

* [How I got 50 Followers on ProductHunt in 5 Minutes using AI](https://ainiro.io/blog/how-i-got-50-followers-on-producthunt-in-5-minutes-using-ai)

... then come tell me how this is just some _"innocent gaming hustling some few bucks out of rich investors"_ ...

## The price for your Soul

I did some math on the above merchant's offers, and to purchase 68,000 accounts such as Supabase probably did, would cost you somewhere between $70,000 and $1.2 million, depending upon how many mature accounts you'd want.

Supabase got some 100 million in VC funding in total, implying they spent less than 0.5% of their liquidity on purchasing their likes. For a CFO and a CMO strategising to figure out how to grow their company, this is practically _"free marketing"_, sustaining the illusion of a popular project worth billions of dollars, allowing them to milk their investors for even more money, to buy whatever it is they want to buy for other peoples' money ...

However, once money is involved, it's still security fraud - Especially once institutionalised investors are involved. The brilliance of the scam is that the VC firm will never publicly admit they were taken for a ride, it's simply too embarrassing for them, so Supabase probably got away 100% clean ...

> The irony ... 😕

Supabase's CEO once patronised me by saying; _"Your system is really good at sending emails"_ - Well, I wouldn't expect anything more from somebody who can only deliver fake value based upon Ponzi schemes, created to dupe money from investors, by gaming the world ...

... maybe I should send his investors some emails ...? 😉

## Conclusion

Since late 2022, less than 1% of Supabase's GitHub star gazers are actually real living human being, the rest are likes they've purchased. In the period before that, starting from 2021, probably 95% or more of their likes are fake.

Any mathematician can verify that what I tell you is the truth. It is simply statistically impossible for nature to create such a smooth line in a natural system ...

This implies that when Supabase is telling you _"We've installed 1 million databases"_, you would be wise removing at least 2 zeros from their numbers, implying they've probably not got more than some 3,000 to 4,000 actual likes, and probably somewhere around 10,000 to 100,000 real legitimate users.

The above should put their evaluation down by at least 1 to 3 zeros, implying instead of being worth 1 billion US dollars, their real evaluation is rather somewhere between 10 million dollars to 100 million dollars somewhere ...

## A Healthy GitHub Project

**Edit** - Below is how a healthy GitHub project should look like. This project obviously has exclusively organic Stargazers.

![Healthy GitHub project](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/w4r29kotbc5xktzn0u6g.png)

The straight line you find in projects such as Supabase, and also MongoDB for that matter, is simply not possible to explain using any known natural phenomenas.

**Edit** - _"That feeling"_ when you know somebody is **really, really, really** angry at you ... 😂

![Chatbot](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/b48p6uupv8f7tlroexz4.png)

**Edit 2** - A follow up article about [Supabase versus Magic](https://dev.to/polterguy/supabase-versus-magic-you-win-5n) to explain what I _really_ feel about it ...