241–250 of 325 posts
I was expecting this article to be a promotion of their audit tool considering a thread about it was flagged as spam less than two weeks ago[1] Turns out it indeed is. Interesting article nonetheless, but it's quite ironic that it's about spam [1] https://news.ycombinator.com/item?id=35233877
But apparently it was REAL SPAM, there goes the credibility..
Spam problems can be solved by - Cross-Internet reputation system for accounts - Small fee on submission
When I did a coding boot camp, one of our assignments was to push a package to RubyGems. It didn't matter if the package did anything; just make up a name and publish it. I'm pretty sure this kind of thing was a common practice with other boot camps, and applied to NPM as well. I always despised how this effectively trashes the repository and represents a complete waste of digital space, no matter how insignificant,…
I thought the same thing and researched how NPM packages get deleted. They need to be manually deleted by the owner and the safeguards are all to protect dependents. There is no incentive to maintain or cleanup old npm packages you have published. They really should have some kind of automated check to clean out packages that are years old, have no imports and no recent version changes. Especially when intuitive name…
Searching for the string "down_load_ebook" does unearth a lot of packages. https://www.npmjs.com/search?q=down_load_ebook About 100k spam packages, with no false positives that I can see.
https://www.npmjs.com/search?q=zip-mp3-a-lbum
Earlier quoted context omitted.
Captcha is an alternative to small fee, cause solving it automatically costs money. Real fee will scare away almost all amateur developers and almost all professional developers who don’t already have a business account available.
I run a big web property with great SEO ranking, and captcha definitely does not deter the spam. A lot of this spam is posted by actual humans.
Why doesn’t this happen with GitHub? GitHub also has very good domain authority.
Many package managers are on this path too.
https://github.blog/2022-07-26-introducing-even-more-securit...
Or fork a Commonjs package that became a ESM-only package and backport changes to the package.
Spam problems can be solved by - Cross-Internet reputation system for accounts - Small fee on submission
Do you have an example for cross-community reviews?
https://www.google.com/search?q=stackoverflow+review+queue&t...
Earlier quoted context omitted.
Ok, I see your point, but this creates another risk that you could end up on the GitHub page of an imposter repository that directs you to npm install from a typo-squatted malicious version of the package you're looking for.
As apposed to Google serving a typo-squatted malicious version of the package above the one you're looking for, directly from npm registry?
That's not to say you don't have a point. It's kind of a damned if you do, damned if you don't situation with multiple underlying and partially conflicting causes (tyosquatting vs. SEO spam).
IMO, the best solution to the SEO spam is for npm to increase the burden of automated signup. Add more CAPTCHAs or even phone verification. And trigger alerts when there are suddenly thousands of new signups, or thousands of packages pushed from one account.
Also, they could add rel=nofollow to all links on the page. This would make it less of an attractive target for SEO spam (but not entirely, since the page itself might still rank highly and the spammer doesn't necessarily care about getting link juice out of it, so much as getting traffic to the npm page itself).
When I did a coding boot camp, one of our assignments was to push a package to RubyGems. It didn't matter if the package did anything; just make up a name and publish it. I'm pretty sure this kind of thing was a common practice with other boot camps, and applied to NPM as well. I always despised how this effectively trashes the repository and represents a complete waste of digital space, no matter how insignificant,…
To me seeing these types of behaviors from an applicant would be a pretty big red flag. I'm just thinking of the disaster that was Hacktoberfest 2020 after a YouTuber popular among bootcampers and students in India taught his audience how to make a (spammy) PR in order to win a 5$ T-shirt. [0]
A pattern I've seen with bootcamps is that students will build a "portfolio" on GitHub and everyone from the same cohort will build the exact same project because most of the bootcamp is a "fill in the blanks" exercise from the same template. As in, there's a 95% match among the same cohort. This type of "GitHub gaming" was pushed to the extreme by someone who created one package for every ANSI escape code. All of his packages end up including one another and the author PR'd them into popular projects so using those give him downloads and boost his rank [1].
We pretty much stopped recruiting from bootcamps because the signal to noise ratio was just too low.
[0] https://joel.net/how-one-guy-ruined-hacktoberfest2020-drama