What I find interesting with NPM is that it pushed the boundries of the Unix philosophy (build a tool to do one thing well) and it turns out that this philosphy can suffer from even small amounts of narcissism, machiavellianism, and psychopathy. people were able to compose and reason about large amounts of complexity with these simple modules but the devil was in the details (literally).
50% of new NPM packages are spam
151–160 of 325 posts
Re: 50% of new NPM packages are spam
#152> ... SEO spam. That is - empty packages, with just a single README file (...) All the identified spam packages are currently live on npmjs.com How is that possible? It seems it would be trivial to filter out spam based just on the observation above, why is it not done? (I'm (obviously) not familiar with the process of submitting an NPM package, so I'm genuinely curious how this works).
I guess the reason is to avoid punishing newbies for one that are doing baby's first NPM tutorials.
The other problem is if you make a rule "reject npm packages with only a single file called README". The spam bots will just add another fake file.
This is a race to the bottom and requires far more aggressive fighting.
Re: 50% of new NPM packages are spam
#153Remember this is a Microsoft product. They certainly have the resources to resolve this if they want to.
Microsoft is pretty hands off when it comes to their acquisitions the last decade.
And moreso, this is GitHub's product (they acquired it, not the larger MS org), the GitHub group is still fairly independent of Microsoft. I can imagine GitHub doesn't give a shit as they continue to push people to use the GitHub package registry instead.
Re: 50% of new NPM packages are spam
#154Is this outcome a point against having centralized registries? Why not go straight to the source code host?
This is basically what I was doing in the 80s and 90s, downloading compressed tarballs from ftp sites and compiling them. It takes quite a longer developer time than the package manager approach. That includes the time to learn which sites you can trust (probably none today) and which dependencies to use (usually listed in the README.) Furthermore there would be a big incentive to use very few libraries: this is both…
The registry-less dependency management is how Go works today, and doesn't have those problems. It's even less developer time than NPM.
1. No need to spend time publishing, just push a commit
2. No need to `npm i` or edit a file, modules can be inferred from imports because they use FQDN
Re: 50% of new NPM packages are spam
#155Just think of it, there is a real developer who decided to do this. Spam is immoral, but doing that to an open source repository is your personal all time low.
Yes but they don't care. Some people don't care if they are immoral. That's why you need regulations and punishments to stop them.
and yet the collateral cost of regulations and punishments on good/innocent people is often far worse than the damage caused by spammers. "regulate all the things" people often underestimate how poorly regulation solves the problems they set out to solve and how it often creates new ones.
Re: 50% of new NPM packages are spam
#156Re: 50% of new NPM packages are spam
#157Earlier quoted context omitted.
I don't think this kind of spam is new. Its just your perspective that determines this is immoral . An argument can be made that any tool built to gain SEO advantage is also borderline immoral and those tool exists for almost a decade now. There are and have been bots to generate SEO content and/or spam websites and custom plugins for Wordpress which achieve that. All to game the search engine. This too is immoral as…
Many years ago I quit my job at a search engine company for my personal ethics, because they had me start manipulating search results based on who paid for their entries.
Good on you to stand by your ethics.
This is the way.
Re: 50% of new NPM packages are spam
#158Just think of it, there is a real developer who decided to do this. Spam is immoral, but doing that to an open source repository is your personal all time low.
I think "immoral" is a reach as a description of spam, and to be crystal clear I'm not defending spam. How is spam any more immoral than ads in a web page? Both are inserting advertising into a channel that a user is accessing information through, as a way to raise revenue or change behavior. (Spam is not by definition phishing, any more than banner ads are innately phishing, though phishing can be served through bot…
Because, like so many things, context matters.
Ads have a place in the world, where we expect to see them (whether we like them or not), and typically most ads are not trying to pass as non-ads (yes of course there are exceptions to this).
The difference here is that these exist in a place where ads should not be, as per the description and use of the service. And it also subverts the experience the service owner is trying to provide.
Imagine if you accept a "free sample" box of cereal and you get home and open it and it's just full of flyers, instead of being full of cereal.
Or this is why you can't just go to any private space like a shopping mall with a megaphone and a sandwich board and start advertising your services without permission. Security will ask you to leave, because the owner of the mall didn't agree to this.
Re: 50% of new NPM packages are spam
#159Would be great if npm->github->microsoft partnered up with https://socket.dev to get a crude filter and take down any obvious malicious/spam packages.
Re: 50% of new NPM packages are spam
#160Just think of it, there is a real developer who decided to do this. Spam is immoral, but doing that to an open source repository is your personal all time low.
I think "immoral" is a reach as a description of spam, and to be crystal clear I'm not defending spam. How is spam any more immoral than ads in a web page? Both are inserting advertising into a channel that a user is accessing information through, as a way to raise revenue or change behavior. (Spam is not by definition phishing, any more than banner ads are innately phishing, though phishing can be served through bot…
We accept ads because in return we usually receive a product or service for free. It's an unwritten contract that society has accepted.
Spam on the other hand is nothing more than guerrilla advertisement. It's obnoxious. It serves no purpose other than to it's creator. It provides no benefit to end users or society.
Sounds kinda immoral if you ask me.