Just think of it, there is a real developer who decided to do this. Spam is immoral, but doing that to an open source repository is your personal all time low.
[flagged]
50% of new NPM packages are spam
81–90 of 325 posts
Re: 50% of new NPM packages are spam
#82Just think of it, there is a real developer who decided to do this. Spam is immoral, but doing that to an open source repository is your personal all time low.
Life makes much sense when you consider it to have the ethics of professional motorsports racing. There, there is no sense of ethical behaviour, as long as you act within the rules you can do anything. That is how modern F1 driving came to be. The F1 team engineers say that designing the cars consists of looking at the new rules and working out how to bend and subvert them.
All of life is like this. People exploit anything in order to make a living, and that is fine. The solution for this is to make it so that people do not need to do such things just to make a living.
EDIT: More succinctly, if you want the world to make sense to you, you should not expect people to put your personal ethical viewpoints above their improvement of their material conditions.
Re: 50% of new NPM packages are spam
#83Just think of it, there is a real developer who decided to do this. Spam is immoral, but doing that to an open source repository is your personal all time low.
> but doing that to an open source repository meh. It's owned by Microsoft - aside from the regular morals of spam and whatever, I don't think it's especially bad to target a Microsoft property. How much of the NPM registry actually is open source?
How about instead of who owns it, ask who uses it?
Re: 50% of new NPM packages are spam
#84Earlier quoted context omitted.
So true. It's truly sad that some people can hold tight to their cynicism even as they build up their technical skills
The people who do this are likely not American or Western European, likely not from a wealthy background, likely don't have access to high end tech jobs, and probably can't even make 5% of what a Facebook or Google employee makes. These people might feel spite and anger towards the western world for the extreme lavish excess that developers enjoy. It's not hard to imagine a world where developers can learn some skill…
Wow
Trust me if you are struggling to make ends meet, you don’t have time for these kind of childish revenge.
Only reason you see developers from some developing countries developing spam related products is because it pays bills. When your livelihood depends upon such products, it is hard to do the right thing. Just like so many people in the west working for very questionable companies.
Re: 50% of new NPM packages are spam
#85Earlier quoted context omitted.
The people who do this are likely not American or Western European, likely not from a wealthy background, likely don't have access to high end tech jobs, and probably can't even make 5% of what a Facebook or Google employee makes. These people might feel spite and anger towards the western world for the extreme lavish excess that developers enjoy. It's not hard to imagine a world where developers can learn some skill…
Being jealous isn't a justification for any action
I think you mean to say that you don't respect actors who justify their actions through "jealousy". In reality, jealously is a fine justification for actions and arguably the most used justification for any action in human history. Hard to think of a historical war that wasn't based on "jealousy", in the end.
I kind of feel like your comment is like saying "Being poor isn't an excuse for stealing bread", and while completely and totally true, it really works hard to miss the point.
Re: 50% of new NPM packages are spam
#86Spammers are possibly trying to take advantage of npmjs.com domain's high Google rank. I found and reported this spam account [1] with links to download movies. They seem to be using npmjs as a free web host with good SEO. [1] https://www.npmjs.com/~aarilzd
If the spammers only want to be indexed, then NPM should disable indexing for major search engines. But still allow it to be indexed other ways, which aren't unearthed on Google search. Other ideas include: do not index new packages before they've garnered enough downloads.
Google search is an extremely common way to discover packages. Disabling indexing entirely isn’t a valid solution.
Downloads are very easy to fake. Usually package managers don’t allow indexing until the package and its author reach a certain age. This allows the team to discover and remove the package before it is indexed.
Re: 50% of new NPM packages are spam
#87Earlier quoted context omitted.
> but doing that to an open source repository meh. It's owned by Microsoft - aside from the regular morals of spam and whatever, I don't think it's especially bad to target a Microsoft property. How much of the NPM registry actually is open source?
How about instead of who owns it, ask who uses it?
I don't think this would affect most developers? The value of NPM is a host of packages that you reference in package.json, not its web UI.
The spam on the web UI is dangerous for victims that land there via search engines, but I don't think this would affect NPM's actual users that much?
Re: 50% of new NPM packages are spam
#88Earlier quoted context omitted.
As a developer, I want npm package information and docs to show up in search. What case is there when you want to find a package in NPM, and information about that package, using Google? If you want information about the package then it's find if the NPM package page is missing from the results - so long as you're getting the package's homepage or git repo then that's plenty. From there you can get to it's NPM page.…
> there is no overlap in the Venn diagram of "searching for a package" and "searching for information about a package". I don't know, if I want information about something, it seems pretty reasonable that I might do my search for that something.
If that's the case then you're doing the second of the two searches, and if the NPM package wasn't in the results but its Github repo or homepage was you're still getting the results you wanted.
For any search where you don't know what you want Google without NPM pages works fine.
For any search where you do know what you want NPM's search function works fine.
There isn't a case where you need Google to interleave pages from the wider internet with pages from NPM. You only think you want that because it's what you're used to, or because you use Google to do searches that you should really do on NPM instead.
Re: 50% of new NPM packages are spam
#89Earlier quoted context omitted.
So true. It's truly sad that some people can hold tight to their cynicism even as they build up their technical skills
The people who do this are likely not American or Western European, likely not from a wealthy background, likely don't have access to high end tech jobs, and probably can't even make 5% of what a Facebook or Google employee makes. These people might feel spite and anger towards the western world for the extreme lavish excess that developers enjoy. It's not hard to imagine a world where developers can learn some skill…
> The people who do this are likely not American or Western European
Maybe not natively, but they may be working in the US or Western Europe, making upwards 50% of a Google/Facebook salary, if not working at Google/Facebook indeed.
Plenty of companies pay a decent salary for mediocre work, and will take the less morally sound developer, because the sound one isn't willing to work with their legacy code or less moral product (e.g., oil industry, financial services). Making good money in tech != good morals.
Finally, being physically in the US/Western Europe doesn't necessarily imply that you don't think that russia deserves to be treated better.
Re: 50% of new NPM packages are spam
#90Earlier quoted context omitted.
The people who do this are likely not American or Western European, likely not from a wealthy background, likely don't have access to high end tech jobs, and probably can't even make 5% of what a Facebook or Google employee makes. These people might feel spite and anger towards the western world for the extreme lavish excess that developers enjoy. It's not hard to imagine a world where developers can learn some skill…
Wow Trust me if you are struggling to make ends meet, you don’t have time for these kind of childish revenge. Only reason you see developers from some developing countries developing spam related products is because it pays bills. When your livelihood depends upon such products, it is hard to do the right thing. Just like so many people in the west working for very questionable companies.
[deleted]