Which open-source project is used where, for how long, and how widely — verifiably anonymously?
Prometheus v2 is a decentralized, fully public platform for the anonymous measurement of the reach and usage duration of open-source software. It delivers what the OSS economy systematically lacks: solid, reproducible, anonymous reach and runtime data — as Open Data, hosted on several independent mirrors, checkable via a Public Audit Log, secured by k-anonymity and (from phase 2) ZK-SNARK attestation.
Why now#
OSS carries more than 90 % of modern software value creation, yet maintainers and foundations largely decide on roadmap, sunset and funding "by gut feel". Vendors do not know their dependency health situation in any depth. Research has to build its own crawlers. Existing tools (NPM downloads, GitHub stars, Libraries.io) show only reach, not usage duration, not activity, and not verifiably anonymously.
Prometheus closes that gap — in a way that is nobody's property and that nobody can switch off.
What it is#
- Four parallel capture modes:
- A Self-instrumentation SDK inside the OSS library (runtime usage)
- B End-user agent in the host software (from phase 2)
- C Hybrid local aggregator (phase 2)
- D Public registry scraping (reach via public manifests)
- k-anonymity as a schema constraint (
k=5default,k≥25for modes B/C) - Open Data by default (CC-BY-4.0 proposed, licence finalised in
ADR-v2-0004) - Decentralized, no central operator — federated mirrors with gossip replication, Public Audit Log (Sigstore Rekor)
- Verifiability instead of trust — ZK-SNARK attestation from phase 2, threshold consensus from phase 3
Stakeholders & value#
| Persona | What Prometheus delivers |
|---|---|
| OSS maintainers & foundations | Evidence for funding applications, roadmap prioritisation, sunset decisions — without running a data pipeline of their own |
| Software vendors | Dependency health snapshots, supply-chain early warning, industry benchmark — all from Open Data |
| Research & the public | A reproducible data backbone (Parquet/CSV.gz daily), Public Audit Log, CC-BY-4.0 |
| Security community | A prospective reach view of unmaintained libraries, correlation with CVE databases |
Phase roadmap#
- Phase 1 — Reach & Runtime MVP (~10 weeks): Track A (registry scraping) and Track B (JS and Python SDK) in parallel, one bootstrap mirror in the EU, Open Data snapshots, Public Audit Log from day 1. K1–K7 are the acceptance tests (see
02-poc-spezifikation.md). - Phase 2 — Federation & ZK (~Q3 2026): end-user agent (B), hybrid aggregator (C), ZK-SNARK attestation for k-anonymity (mandatory), a second independent mirror, gossip federation, mix-net submission (recommended).
- Phase 3 — Threshold consensus (~Q1 2027): ≥ 3 mirrors, threshold consensus. (The further SDK languages Java/Go/Rust/.NET, the build-tool plugins Maven/Gradle/cargo/npm and the cross-language conformance suite were pulled forward and are already implemented in P1-Ph3 — cf.
01-konzept.md§6.)
What we need from you#
(This is not an investment pitch — Prometheus has no central operator and no tenant market. The ask is participation, not money into a legal entity.)
- Mirror hosting in the EU for the phase-1 pilot period (foundation sponsorship, university data centre, OSS foundation). Requirement: 1 vCPU, 8 GB RAM, 500 GB SSD, capable of running ClickHouse, publicly reachable over HTTPS.
- A pilot OSS library (maintainer cooperation): one popular JS or Python package willing to embed the SDK in a pre-release version and to make phase-1 telemetry publicly available.
- A research partner (university / OSS analytics group): to try out the K6 acceptance test ("does a researcher answer the reach-doubling question over the Open Data dump in under 2 minutes?").
- Foundation legal clearance for the Open Data licence: CC-BY-4.0 is decided in
ADR-v2-0004(status: accepted), and phase-1 snapshots already appear under it with a provisional clause. What remains open is only the final legal clearance; should the advice come back negative, a re-issue under a new snapshot ID follows. The GDPR assignment is decided (P1-4 closed: the mirror operator is the sole data controller, matrix ininfrastructure-map.md§4.5) — no decision is being sought there any more. - Calibration of the anti-Sybil thresholds (
06-offene-punkte.mdP3-7): the mechanism has been settled sinceADR-v2-0007(P1-2 closed) — rate limit per DID, cross-mode plausibility, burn-in; proof of work was rejected there with reasons (wasting end-user CPU, botnet asymmetry). What is wanted is empirical data on the thresholds, not new mechanism proposals.
What Prometheus is not#
- Not an SBOM generator (Syft, CycloneDX, SPDX are complementary).
- Not a vulnerability scanner (OSV, GHSA remain responsible for that).
- Not a maintainer ranking — no person-related aggregates.
- Not a commercial SaaS — no tenants, no paywall, no vendor legal entity.
Cross-references#
01-konzept.md·02-poc-spezifikation.md·03-risikoprofil.md05-zero-knowledge-vorschlag.md·06-offene-punkte.mdsystem-overview.md·data-flow.md·threat-model.md- ADRs
ADR-v2-0001…ADR-v2-0004 - v1 archive:
files/v1/(SaaS adoption concept before the 2026-05-26 pivot)