Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

70% of new NPM packages in last 6 months were spam

blog.phylum.io

Post reply on HN
Print view View original

111–116 of 116 posts

Re: 70% of new NPM packages in last 6 months were spam

#111

Post by 3np »

alright2565 wrote: post #78
3np wrote: post #24

Earlier quoted context omitted.

That would be a clear violation of the npm Unpublish Policy[0]. If all it takes is some spam and pissing people off to walk away from principles, they never meant anything. A proper response needs to not break expectations like this. [0]: https://docs.npmjs.com/policies/unpublish

No, it isn't? The unpublish document describes the options that users of NPM have to remove packages themselves. It was created after some situation where someone unpublished an important package. A whole different set of terms governs which packages NPM can remove. This definitely includes these packages, either as "abusive" or "name squatting" Not only that, but NPM's TOS makes it very clear that you have no recour…

> Registry data is immutable, meaning once published, a package cannot change. We do this for reasons of security and stability of the users who depend on those packages. So if you've ever published a package called "bob" at version 1.1.0, no other package can ever be published with that name at that version. This is true even if that package is unpublished.

This statement makes assertions and sets expectations for both publishers and users. It would be senseless if npmjs would start arbitrarily "taking down" packages on their own discretion simply because they include a tea.yaml file (as proposed in the comment I replied to).

Re: 70% of new NPM packages in last 6 months were spam

#112

Post by andai »

wokwokwok wrote: post #59
andai wrote: post #55

Earlier quoted context omitted.

Daydream? It worked for Phi.

This is such a low effort insincere comment I can barely be bothered to respond to it… but tldr; no, it didn’t. If it was easy, people would have done it. It’s not easy. Phi is not a state of the art model. It does not perform significantly better or even on par with larger models. Yes, I’ve read the tech reports and used it. No, I don’t believe it has any kind of meaningful bearing on the problem, which is explicitl…

I'm confused. Are you saying that removing low quality inputs from training data doesn't improve a model? (Or conversely, adding high quality inputs.) Or are you saying that we don't yet have the technology to reliably do this at scale?

Re: 70% of new NPM packages in last 6 months were spam

#113

Post by wokwokwok »

andai wrote: post #112
wokwokwok wrote: post #59

Earlier quoted context omitted.

This is such a low effort insincere comment I can barely be bothered to respond to it… but tldr; no, it didn’t. If it was easy, people would have done it. It’s not easy. Phi is not a state of the art model. It does not perform significantly better or even on par with larger models. Yes, I’ve read the tech reports and used it. No, I don’t believe it has any kind of meaningful bearing on the problem, which is explicitl…

I'm confused. Are you saying that removing low quality inputs from training data doesn't improve a model? (Or conversely, adding high quality inputs.) Or are you saying that we don't yet have the technology to reliably do this at scale?

I again, can’t comprehend how this can possibly be ambiguous from my comment, but the second one.

We don’t (by all accounts, no one does) have a way to create this kind of dataset at scale, in this kind of complex user contributed content environment (specifically npm and other places like it).

Re: 70% of new NPM packages in last 6 months were spam

#114

Post by andai »

wokwokwok wrote: post #113
andai wrote: post #112

Earlier quoted context omitted.

I'm confused. Are you saying that removing low quality inputs from training data doesn't improve a model? (Or conversely, adding high quality inputs.) Or are you saying that we don't yet have the technology to reliably do this at scale?

I again, can’t comprehend how this can possibly be ambiguous from my comment, but the second one. We don’t (by all accounts, no one does ) have a way to create this kind of dataset at scale, in this kind of complex user contributed content environment ( specifically npm and other places like it).

Microsoft's curation techniques for the Phi models remain proprietary. So we can't really criticize or praise their methods, because we don't know what they are. It might be GPT-4. It might be Artificial Artificial Intelligence (a warehouse in Pakistan). But the results speak for themselves.

The models are a bit janky in my testing (especially prone to leaking test materials, and highly specialized on a narrow domain), but fantastic for their size.

Intentional "under-generalization" seems like a fairly self-evident approach to making optimal (and economical, on the training side) use of smaller models.

As for whether it works for a general purpose model, my intuition says that it does (i.e. cutting off the "long tail of knowledge" in favour of a better handling of the mainstream, by the limited neurons available).

As for whether that tech exists, I reckon a simple tf-idf would get you 80% of those wins, but that might be ignorance/arrogance on my part.

Post reply on HN