5 ms·
Spam problems can be solved by - Cross-Internet reputation system for accounts - Small fee on submission
by miohtama 4y ago
Spam problems can be solved by
- Cross-Internet reputation system for accounts
- Small fee on submission
- throwaway290 4y agoNPM for companies costs enough that it surely covers all the reviews already.
- ehutch79 4y agoIt’s not about revenue, it’s about making spam unprofitable. Charging 0.25$usd is enough to make spam not worth it. It also attaches an identity to the posting.
- JosephRedfern 4y agoI think the suggestion was that the revenue generated by NPM's commercial dealings should cover any cost associated with a review process for OSS submissions (which in itself would make such spam repositories ineffective)
- ehutch79 4y agoSo, let the spam happen, and remove it after the fact using humans? Or hold all submissions until a human reviews it?
- JosephRedfern 4y agoI'm just clarifying my interpretation of OP's comment, not necessarily agreeing with it. Anyway, involving humans (funded by NPM's commercial revenue) doesn't reduce the options to "letting the spam happen and dealing it after the fact" or "holding all submissions until a human reviews [them]". If I was trying to solve this problem, I'd be open to a solution that tried to automatically classify submissions as either legitimate or spammy, with an associated confidence level. If the confidence level fell below a given threshold then I'd involve a human.
- throwaway290 4y agoYes, the first one. Not exclusively with using humans to develop better detection of spam.
- mr90210 4y agoI don’t see anybody paying to submit a package to a registry. Even if NPM didn’t support other registries or direct installs from a versioning system, different tools would have been created by the community.
- gregoriol 4y agoSmall fee to submit open-source packages?
- pipo234 4y agoIe.: Open source = free as in speech, and cheap as in beer ;-)
- verdverm 4y agosounds like twitter's new strategy
- nailer 4y agoIt's a good strategy. Suddenly spam costs money.
- verdverm 4y agoDoes spam costing more money stop spam? Does it cost money per account, project, version? If I can make $100 from one victim, is this spam still profitable? What happens to the international developers who cannot easily get a payment method setup? Does a $10/m "identity verification" stop a nation state from using the platform to influence?
- pipo234 4y agoFair argument. The spam fee should be proportional to the amount of spam rather than account or fixed monthly fee. Some kind of micropayment per spam item. Per repo, or per commit / per release in case of NPM? Micropayments on internet have always proven difficult to implement. No silver bullets.
- blowski 4y agoWhen there's so much spam, there's a cost to everyone.
- 4y ago
- pipo234 4y ago> - Cross-Internet reputation system for accounts Gets rid of anonymous spam. > - Small fee on submission Gets rid of amateur spam. I guess that's 98% of the problem. I think this is a good start. What to do about bogus projects sponsored by wealthy companies? What about abandonware? And how do we remain open and inclusive to newbees?
- justinclift 4y ago> What to do about bogus projects sponsored by wealthy companies? Does this happen in the real world, rather than as a theoretical concern? As a thought, when a problem is pressing then sometimes it's best to start with a reasonable action then course correct over time. Rather than doing nothing waiting for a perfect solution.
- mnw21cam 4y ago> Does this happen in the real world, rather than be a theoretical concern? Heck yes. 99% of the stuff advertised to me in big money advertising campaigns is stuff that I will never want. If that doesn't count as "bogus projects sponsored by wealthy companies" then I don't know what does.
- mindcandy 4y agoIn the real world, do wealthy companies want to be named on this list of 3 or 4 groups spamming NPM? That’s a lot different than being seen buying a banner ad.
- pipo234 4y agoThat's probably where the reputation part would come in - fair enough. Still, a large wealthy company might consider creating an "unaffiliated" front company to act on their behalf. For example, take out a legit open source competitor by having the front publish a mediocre bogus project with very similar name. Or paying a small fee to bundle malware into a legit FOSS. So, similar to Twitter's blue check mark - Yes, asking a "small fee" adds friction, but it's not an obstacle to the wealthy.
- newswasboring 4y ago> Small fee on submission This will immediately bias the submissions only coming in from the west. Remember you can make the fee small but sometimes a person can't even pay even if they have the money. I remember having the 1000 or so rupees required for some VPS stuff when I was a teenager and not being able to pay since I didn't have a credit card. I hope we don't ever make money a barrier to open source.
- duxup 4y agoAre people who submit to NPM really that short on cash? I doubt it.
- cacois 4y agoPlease thoroughly read the comment you are replying to.
- Raed667 4y agoA lot of counties (like mine) don't have access to global payments. Having a card in Euro or USD requires special paperwork.
- traveler01 4y agoFrom my experience cryptocurrencies are helping countries overcome that. But still, money wouldn't be a solution for this issue.
- mschuster91 4y agoYou'd have to get cryptocoins in the first place, and there are countries which ban all kinds of cryptocurrency (China) or place it behind onerous KYC requirements (EU, US).
- duxup 4y agoDo you mind if I ask what country?
- madsbuch 4y agoThe fee structure is the most interesting in my perspective. It would be interesting to see how an open source platform could combat this with a gas-fee structure using their own token economy. You'd need to get tokens to submit, which you can get by donations by engaging with a community, or by buying them, etc.
- ndespres 4y agoThis old gem comes to mind in any conversation about how to alleviate spam problems: https://craphound.com/spamsolutions.txt https://craphound.com/spamsolutions.txt
- wruza 4y agoCaptcha is an alternative to small fee, cause solving it automatically costs money. Real fee will scare away almost all amateur developers and almost all professional developers who don’t already have a business account available.
- bkanber 4y agoI run a big web property with great SEO ranking, and captcha definitely does not deter the spam. A lot of this spam is posted by actual humans.
- wruza 4y agoClearly, captcha only works in the same budget category. If that spam “business” endures hiring humans, it will easily swallow small fees too.
- marban 4y agoDo you have an example for cross-community reviews?
- acomjean 4y agoEssentially this is what academic journals are doing. Every paper should be reviewed manually. Of course that costs some money (although the reviewers aren’t paid).
- verdverm 4y agoAnd they often barely validate the actual work, many times passing it on to subordinates.
- wruza 4y agoStackoverflow does that. As a regular user you can contribute by reviewing q&as from a special queue, it’s next to your username+score div. https://www.google.com/search?q=stackoverflow+review+queue&tbm=isch https://www.google.com/search?q=stackoverflow+review+queue&t...
- hnbad 4y ago- Abolishing capitalism Wait, I may have been overdoing it with root cause analysis again.
- rk06 4y agoA small fee on package creation/account creation would be better.
- pjc50 4y agoThe fees are in the wrong direction. Submitters of good npm packages should be paid. (The overall lack of quality control on npm is a separate question)
- thenerdhead 4y agoPackage managers have a hard enough time managing packages. Imagine them having to manage payments...