Live data from Hacker News

50% of new NPM packages are spam

blog.sandworm.dev

161–170 of 325 posts

Re: 50% of new NPM packages are spam

#161
post #22

Just think of it, there is a real developer who decided to do this. Spam is immoral, but doing that to an open source repository is your personal all time low.

The world is based on making money. This can easily be a real developer working somewhere where their wages are dirt and this is a easy way to make money.

Ethics and feelings don't make money or keep food on the table.

Re: 50% of new NPM packages are spam

#162
post #158

Earlier quoted context omitted.

I think "immoral" is a reach as a description of spam, and to be crystal clear I'm not defending spam. How is spam any more immoral than ads in a web page? Both are inserting advertising into a channel that a user is accessing information through, as a way to raise revenue or change behavior. (Spam is not by definition phishing, any more than banner ads are innately phishing, though phishing can be served through bot…

Because, like so many things, context matters. Ads have a place in the world, where we expect to see them (whether we like them or not), and typically most ads are not trying to pass as non-ads (yes of course there are exceptions to this). The difference here is that these exist in a place where ads should not be, as per the description and use of the service. And it also subverts the experience the service owner is…

Much more eloquently composed response than mine.

Re: 50% of new NPM packages are spam

#163
post #22

Just think of it, there is a real developer who decided to do this. Spam is immoral, but doing that to an open source repository is your personal all time low.

> but doing that to an open source repository meh. It's owned by Microsoft - aside from the regular morals of spam and whatever, I don't think it's especially bad to target a Microsoft property. How much of the NPM registry actually is open source?

It's owned by GitHub first and foremost. Microsoft owns GitHub but there's independence between the two.

Re: 50% of new NPM packages are spam

#164
post #96
post #22

Just think of it, there is a real developer who decided to do this. Spam is immoral, but doing that to an open source repository is your personal all time low.

Probably an unpopular opinion, and I realize I'm kind of ranting on a relatively unrelated subject, but I have become really dissuaded with the Node ecosystems dependence on seemingly boundless dependency trees. The fact that Window's file system can't handle moving project directories (without deleting the node_modules), and relatively simple projects using megabytes of raw text to work... anyways. While I understan…

What's that got to do with it being low to spam them?

Re: 50% of new NPM packages are spam

#165

Earlier quoted context omitted.

I sometimes run topical searches like to discover packages if I don't know the package name ahead of time. It would be annoying if NPM were not indexed at all.

It would be annoying if NPM were not indexed at all More or less annoying than NPM being used for hosting spam?

That seems like a false choice. Deindexing is not the only way to solve spam. Plenty of other websites have found solutions and didn't have to pull themselves from Google.

Re: 50% of new NPM packages are spam

#166
IMO this isn’t really a problem as long as you have good package discovery mechanisms in place. You won’t slurp up some spam package with little reviews and no ratings if you’re paying attention. Look at all the spam email we get yet never even open.

Re: 50% of new NPM packages are spam

#167
post #22

Just think of it, there is a real developer who decided to do this. Spam is immoral, but doing that to an open source repository is your personal all time low.

I think "immoral" is a reach as a description of spam, and to be crystal clear I'm not defending spam. How is spam any more immoral than ads in a web page? Both are inserting advertising into a channel that a user is accessing information through, as a way to raise revenue or change behavior. (Spam is not by definition phishing, any more than banner ads are innately phishing, though phishing can be served through bot…

> How is spam any more immoral than ads in a web page?

What?

Many websites need ads to survive. Node.js doesn't need spam to survice. It's a quite huge difference, don't you think?

Re: 50% of new NPM packages are spam

#168
post #110

Earlier quoted context omitted.

> What case is there when you want to find a package in NPM, and information about that package, using Google? Coz you might want results not only from docs but stackoverflow and other places ? > Essentially, there is no overlap in the Venn diagram of "searching for a package" and "searching for information about a package". You want one or the other, not a results page with links to both. Of course there is. I want…

Coz you might want results not only from docs but stackoverflow and other places ? Of course there is. I want docs, examples, and maybe opinions vs alternatives if I look to solve problem X with external dependency. You don't need the link to the package in NPM to be in the results for either of these examples.

You're trying real hard to tell people how they _shouldn't_ be doing their work, maybe accept that your opinion, while valid, is just that - your opinion - and that others have their own equally valid ways of approaching their work and their searching?

Re: 50% of new NPM packages are spam

#169
post #22

Just think of it, there is a real developer who decided to do this. Spam is immoral, but doing that to an open source repository is your personal all time low.

Life makes much sense when you consider it to have the ethics of professional motorsports racing. There, there is no sense of ethical behaviour, as long as you act within the rules you can do anything. That is how modern F1 driving came to be. The F1 team engineers say that designing the cars consists of looking at the new rules and working out how to bend and subvert them. All of life is like this. People exploit an…

human life maybe, because more natural life is about survival (without established rules or specs), sometimes at the expense of another, but not for fun, entertainment, nor with a huge pollution footprint as well

Re: 50% of new NPM packages are spam

#170
post #95

Earlier quoted context omitted.

I don't think this kind of spam is new. Its just your perspective that determines this is immoral . An argument can be made that any tool built to gain SEO advantage is also borderline immoral and those tool exists for almost a decade now. There are and have been bots to generate SEO content and/or spam websites and custom plugins for Wordpress which achieve that. All to game the search engine. This too is immoral as…

Many years ago I quit my job at a search engine company for my personal ethics, because they had me start manipulating search results based on who paid for their entries.

I’ve made similar choices, ultimately taking a deep pay cut to do work that matches my values.

But I’m aware that I did that out of decent financial security, not out of some deep moral courage.

If writing spam was my only way out of poverty or to feed my family, I’m sure I would act differently.

Post reply on HN