131–140 of 325 posts
Funny enough, I used to work on a project that requires publishing a new npm package for each major Xcode version (precompiled swift library). I was doing incremental suffixes for some time until npm blocked our releases after a few versions due to suspected spam. Had to do some Roman numerals to walk around it.
Earlier quoted context omitted.
as a developer you can also keep a relatively low number of dependencies, and mainstream or simple ones
That takes awareness and discipline. The last time I tried to learn Node, all the guides led you down a road of dependency hell.
Spammers are possibly trying to take advantage of npmjs.com domain's high Google rank. I found and reported this spam account [1] with links to download movies. They seem to be using npmjs as a free web host with good SEO. [1] https://www.npmjs.com/~aarilzd
Earlier quoted context omitted.
That takes awareness and discipline. The last time I tried to learn Node, all the guides led you down a road of dependency hell.
that takes experience, like everything you want to do well
Spammers are possibly trying to take advantage of npmjs.com domain's high Google rank. I found and reported this spam account [1] with links to download movies. They seem to be using npmjs as a free web host with good SEO. [1] https://www.npmjs.com/~aarilzd
If the spammers only want to be indexed, then NPM should disable indexing for major search engines. But still allow it to be indexed other ways, which aren't unearthed on Google search. Other ideas include: do not index new packages before they've garnered enough downloads.
Earlier quoted context omitted.
As a developer, I want npm package information and docs to show up in search. What case is there when you want to find a package in NPM, and information about that package, using Google? If you want information about the package then it's find if the NPM package page is missing from the results - so long as you're getting the package's homepage or git repo then that's plenty. From there you can get to it's NPM page.…
I sometimes run topical searches like to discover packages if I don't know the package name ahead of time. It would be annoying if NPM were not indexed at all.
More or less annoying than NPM being used for hosting spam?
Just think of it, there is a real developer who decided to do this. Spam is immoral, but doing that to an open source repository is your personal all time low.
Life makes much sense when you consider it to have the ethics of professional motorsports racing. There, there is no sense of ethical behaviour, as long as you act within the rules you can do anything. That is how modern F1 driving came to be. The F1 team engineers say that designing the cars consists of looking at the new rules and working out how to bend and subvert them. All of life is like this. People exploit an…
I'm afraid it can get worse. What happens when there will be a proliferation of "looking legit npm packages" thanks to AI, full with ransomware? Currently I can't really figure out a one size fits all solution to that. Any idea?
One idea that's gaining (marginal) traction in Rust (which really sits in the same boat here) is trusted reviews, where trust is established by a web of trust. You probably have some developers you trust, and they have a different set of people they trust, so you can establish transient trust (that decays as the chain gets longer). The most relevant project for Rust is https://web.crev.dev/rust-reviews/ , not sure if…
Just think of it, there is a real developer who decided to do this. Spam is immoral, but doing that to an open source repository is your personal all time low.
Probably an unpopular opinion, and I realize I'm kind of ranting on a relatively unrelated subject, but I have become really dissuaded with the Node ecosystems dependence on seemingly boundless dependency trees. The fact that Window's file system can't handle moving project directories (without deleting the node_modules), and relatively simple projects using megabytes of raw text to work... anyways. While I understan…
Maybe I shot myself in the foot enough times to have learned what not to do.
Earlier quoted context omitted.
Probably an unpopular opinion, and I realize I'm kind of ranting on a relatively unrelated subject, but I have become really dissuaded with the Node ecosystems dependence on seemingly boundless dependency trees. The fact that Window's file system can't handle moving project directories (without deleting the node_modules), and relatively simple projects using megabytes of raw text to work... anyways. While I understan…
as a developer you can also keep a relatively low number of dependencies, and mainstream or simple ones