Anything free will be abused for spam. Make it pay a small fee to add an npm package, and the problem will disappear. The fee may be going to pay for moderation, for example. To make payments frictionless and anonymous, accept cryptocurrency.
50% of new NPM packages are spam
191–200 of 325 posts
Re: 50% of new NPM packages are spam
#192I feel for the poor person that now has to clean up that mess :( I've been that person in the past and it was no fun
Re: 50% of new NPM packages are spam
#193Is this outcome a point against having centralized registries? Why not go straight to the source code host?
This is basically what I was doing in the 80s and 90s, downloading compressed tarballs from ftp sites and compiling them. It takes quite a longer developer time than the package manager approach. That includes the time to learn which sites you can trust (probably none today) and which dependencies to use (usually listed in the README.) Furthermore there would be a big incentive to use very few libraries: this is both…
The problem is that all the popular NPM packages have so much dependencies that you cannot just download a zip file and install the package on your local computer in order for the library to work, you'd need a way to track all the dependencies...
PHP (composer) or Java (Maven) are less prone to that issue because a composer package can't have 50 versions of the same dependency, unlike NPM. So even if a composer package has 20 dependencies, it's relatively easy to track down and download all of them. NPM dependency tries are often exponentials, a stupid design decision. Version conflicts should be solved upstream, not by the package manager.
But that decision allowed NPM to grow as a business which was eventually bought by Microsoft.
Re: 50% of new NPM packages are spam
#194Just think of it, there is a real developer who decided to do this. Spam is immoral, but doing that to an open source repository is your personal all time low.
Life makes much sense when you consider it to have the ethics of professional motorsports racing. There, there is no sense of ethical behaviour, as long as you act within the rules you can do anything. That is how modern F1 driving came to be. The F1 team engineers say that designing the cars consists of looking at the new rules and working out how to bend and subvert them. All of life is like this. People exploit an…
I think you ignore(?) an important detail that the world is as good as it is due to most people not subverting the rules. While I understand the philosophy and a sort of realism you’re suggesting, I prefer to separate morals from holes in rules internally.
They may or may not feel guilt for this. We may also remove this feeling from our reasoning completely. But that wouldn’t prevent it from glueing things together well enough for them to function. Living in a welcoming environment, with all ethics attached to that, is a fundamental human desire, apart from psychopathological cases. F1 teams managed to negotiate that between themselves and now they’re okay with it - it’s a hard competition all in all. But you’ll have a hard time negotiating $subj’s morality with an open source community of developers and users. The one who spits into a pot of a free meal - is a rat in all countries and cultures. I doubt that F1-ers refrain from spitting on a road just before another box because there’s a rule about it.
Re: 50% of new NPM packages are spam
#195Earlier quoted context omitted.
Life makes much sense when you consider it to have the ethics of professional motorsports racing. There, there is no sense of ethical behaviour, as long as you act within the rules you can do anything. That is how modern F1 driving came to be. The F1 team engineers say that designing the cars consists of looking at the new rules and working out how to bend and subvert them. All of life is like this. People exploit an…
People can, should, and often do have a sense of morality that is different than “whatever is technically legal.”
Yes, people often have a sense of morality that readily accepts doing illegal things, everybody knows that. Whether they should have such sense is debatable because in the end it's a question of opinion: you may be alright with that, I may be not and the others may not even care about what we think about it.
Re: 50% of new NPM packages are spam
#196Spammers are possibly trying to take advantage of npmjs.com domain's high Google rank. I found and reported this spam account [1] with links to download movies. They seem to be using npmjs as a free web host with good SEO. [1] https://www.npmjs.com/~aarilzd
As an aside, something I've seen when reverse-engineering black hat SEO is online casinos sponsoring prominent open source projects in exchange for a sponsorship link. Seems generous until you you realize this also means a huge boost in page rank.
I've seen this in the Linux Mint project [1] with donations coming from carpet cleaning and light fixtures cos. Sometimes you'll see law firms and I.T. consultants. It's a pretty great idea. Counts as a win-win in my books, as long as the biz is legit.
Re: 50% of new NPM packages are spam
#197Just think of it, there is a real developer who decided to do this. Spam is immoral, but doing that to an open source repository is your personal all time low.
The world is based on making money. This can easily be a real developer working somewhere where their wages are dirt and this is a easy way to make money. Ethics and feelings don't make money or keep food on the table.
Having known very well someone who, despite being quite wealthy, practiced online fraud, served jail for this, and now happily works in a middle east tax haven (geez, I know someone else who lost their job just for knowing that guy, talk about having the right connections), I can assure you that although your point is valid , it is not always the case.
Re: 50% of new NPM packages are spam
#198Earlier quoted context omitted.
The people who do this are likely not American or Western European, likely not from a wealthy background, likely don't have access to high end tech jobs, and probably can't even make 5% of what a Facebook or Google employee makes. These people might feel spite and anger towards the western world for the extreme lavish excess that developers enjoy. It's not hard to imagine a world where developers can learn some skill…
Being jealous isn't a justification for any action
On the contrary, jealousy is one of the major drivers of consumerism.
Re: 50% of new NPM packages are spam
#199Earlier quoted context omitted.
So true. It's truly sad that some people can hold tight to their cynicism even as they build up their technical skills
The people who do this are likely not American or Western European, likely not from a wealthy background, likely don't have access to high end tech jobs, and probably can't even make 5% of what a Facebook or Google employee makes. These people might feel spite and anger towards the western world for the extreme lavish excess that developers enjoy. It's not hard to imagine a world where developers can learn some skill…
The charitable summary of your comment is that it is inaccurate.
For one, tech salaries outside of the developed world have been going up at a higher rate than in it for the past 20 years or so - the pandemic and proliferation of remote work only accelerated this process.
As for spite and anger: a tech worker in a poor country is easily within the top 10% (if not 5%) earners there and is usually too financially secure for such nonsense.
The whole crypto debacle showed that scammers are largely evenly distributed around the world - it's just the type and scale of scam that differs.
Re: 50% of new NPM packages are spam
#200Searching for the string "down_load_ebook" does unearth a lot of packages. https://www.npmjs.com/search?q=down_load_ebook About 100k spam packages, with no false positives that I can see.
wow 104,395 packages found
So far the oldest package release I've seen was only 7 days go, all authored by uniquely generated name with the same format:
Random First Name + Random Last Name + Random 4 numbers
https://www.npmjs.com/search?q=down_load_ebook&page=2000&per...