18 ms·
I like that idea too. Though it definitely may lead to some troubling scenarios where bad actors try to get their modules listed as dependencies of popular proj
by colinmcd 6y ago
I like that idea too. Though it definitely may lead to some troubling scenarios where bad actors try to get their modules listed as dependencies of popular projects to piggyback on their downloads. You could alleviate this by not funding dependencies of dependencies but there are some low-level tools (say, CSS autoprefixers) that are rarely used in their "raw form". It's tricky.
- dnautics 6y agoI see this being a major issue in the NPM ecosystem, lol. One thing is you could make transitive dependencies strictly opt-in, or have a decay function.
- SCLeo 6y agoOr each package's maintainer can set a proportion for each of its dependencies, so that every time a donation is received, a certain amount of that donation is automatically transferred to those dependencies according to the proportion set by the maintainer. The donation sent to those dependencies is then propagated to their dependencies automatically according to ratios set by the maintainers of those dependencies.