Was the joke creating JavaScript frameworks is way to get promoted in FANG / MANGA..
50% of new NPM packages are spam
61–70 of 325 posts
Re: 50% of new NPM packages are spam
#62I'm afraid it can get worse. What happens when there will be a proliferation of "looking legit npm packages" thanks to AI, full with ransomware? Currently I can't really figure out a one size fits all solution to that. Any idea?
One idea that's gaining (marginal) traction in Rust (which really sits in the same boat here) is trusted reviews, where trust is established by a web of trust. You probably have some developers you trust, and they have a different set of people they trust, so you can establish transient trust (that decays as the chain gets longer). The most relevant project for Rust is https://web.crev.dev/rust-reviews/ , not sure if…
Looks like there's an implementation of it for npm: https://github.com/crev-dev/crev
I've been willing to try it for a while for Rust projects but never committed to spending the time. Any feedback?
Re: 50% of new NPM packages are spam
#63Just think of it, there is a real developer who decided to do this. Spam is immoral, but doing that to an open source repository is your personal all time low.
So true. It's truly sad that some people can hold tight to their cynicism even as they build up their technical skills
The people who do this are likely not American or Western European, likely not from a wealthy background, likely don't have access to high end tech jobs, and probably can't even make 5% of what a Facebook or Google employee makes.
These people might feel spite and anger towards the western world for the extreme lavish excess that developers enjoy. It's not hard to imagine a world where developers can learn some skills but are locked out participating like we do, and thus decide to weaponize those skills against us for whatever profit they can.
Re: 50% of new NPM packages are spam
#64Earlier quoted context omitted.
One idea that's gaining (marginal) traction in Rust (which really sits in the same boat here) is trusted reviews, where trust is established by a web of trust. You probably have some developers you trust, and they have a different set of people they trust, so you can establish transient trust (that decays as the chain gets longer). The most relevant project for Rust is https://web.crev.dev/rust-reviews/ , not sure if…
Aand we’re back to PGP/GPG.
https://sigstore.dev (& cosign) seem to be gaining in popularity, ease of setup, and integrations
Re: 50% of new NPM packages are spam
#65Earlier quoted context omitted.
I would find amusement if the solution to the spamming of npm turns out to be a genuinely useful use case for blockchain.
> I would find amusement if the solution to the spamming of npm turns out to be a genuinely useful use case for blockchain. I think you can implement a web-of-trust without a blockchain.
indeed, blockchain makes trusting people much harder. The hijacked sense of "trust" used by the crypto-hype is a trivial technical sense in distributed databases.
Rather, an immutable ledger is a terrible system for trusting /people/, since if the data input into the system isnt reliable, there's no way to change it.
You then need to build an actual layer of trust on top of your untrustable blockchain, and then you end up spending 1MWHr and $100/review to recreate rotten tomatoes.
Re: 50% of new NPM packages are spam
#66I'm afraid it can get worse. What happens when there will be a proliferation of "looking legit npm packages" thanks to AI, full with ransomware? Currently I can't really figure out a one size fits all solution to that. Any idea?
One idea that's gaining (marginal) traction in Rust (which really sits in the same boat here) is trusted reviews, where trust is established by a web of trust. You probably have some developers you trust, and they have a different set of people they trust, so you can establish transient trust (that decays as the chain gets longer). The most relevant project for Rust is https://web.crev.dev/rust-reviews/ , not sure if…
I would love to see this getting bigger, not just for package managers but in general. With AIs it will be easier than ever to produce spam or just poor content. We need some better way to rank and accept content, and apart from having large tech companies hiring armies of reviewiers, I would think web of trust can solve it.
Don't think that requires blockchain per se, or even human verification. It would work quite well just for me to assign my trust to various identities (Github accounts, LinkedIn accounts, etc) and for that trust to be used when ranking or filtering content.
Re: 50% of new NPM packages are spam
#67Earlier quoted context omitted.
Do you have an example for cross-community reviews?
Essentially this is what academic journals are doing. Every paper should be reviewed manually. Of course that costs some money (although the reviewers aren’t paid).
And they often barely validate the actual work, many times passing it on to subordinates.
Re: 50% of new NPM packages are spam
#68Re: 50% of new NPM packages are spam
#69Earlier quoted context omitted.
> Small fee on submission This will immediately bias the submissions only coming in from the west. Remember you can make the fee small but sometimes a person can't even pay even if they have the money. I remember having the 1000 or so rupees required for some VPS stuff when I was a teenager and not being able to pay since I didn't have a credit card. I hope we don't ever make money a barrier to open source.
If only there were some kind of decentralized digital currency a person could use outside of big banks and credit cards..
[Clown emoji]
Re: 50% of new NPM packages are spam
#70> 50% of new NPM packages are spam So all an attacker has to do is to publish an npm package. Wait, this alteady happened.
spam != malware or rootkit (i.e. attacker in the software sense)