5 ms·

> - Cross-Internet reputation system for accounts Gets rid of anonymous spam. > - Small fee on submission Gets rid of amateur spam. I guess that's 98% of th

> - Cross-Internet reputation system for accounts Gets rid of anonymous spam. > - Small fee on submission Gets rid of amateur spam. I guess that's 98% of the problem. I think this is a good start. What to do about bogus projects sponsored by wealthy companies? What about abandonware? And how do we remain open and inclusive to newbees?

justinclift 4y ago
> What to do about bogus projects sponsored by wealthy companies? Does this happen in the real world, rather than as a theoretical concern? As a thought, when a problem is pressing then sometimes it's best to start with a reasonable action then course correct over time. Rather than doing nothing waiting for a perfect solution.
- mnw21cam 4y ago
  > Does this happen in the real world, rather than be a theoretical concern? Heck yes. 99% of the stuff advertised to me in big money advertising campaigns is stuff that I will never want. If that doesn't count as "bogus projects sponsored by wealthy companies" then I don't know what does.
  - mindcandy 4y ago
    In the real world, do wealthy companies want to be named on this list of 3 or 4 groups spamming NPM? That’s a lot different than being seen buying a banner ad.
    - pipo234 4y ago
      That's probably where the reputation part would come in - fair enough. Still, a large wealthy company might consider creating an "unaffiliated" front company to act on their behalf. For example, take out a legit open source competitor by having the front publish a mediocre bogus project with very similar name. Or paying a small fee to bundle malware into a legit FOSS. So, similar to Twitter's blue check mark - Yes, asking a "small fee" adds friction, but it's not an obstacle to the wealthy.
      - justinclift 4y ago
        Most of that seems _very_ theoretical, with the exception of "paying to bundle malware into legit FOSS". Unfortunately, that last one deserves a special Fuck You to the main developers of FileZilla, who have knowingly bundled malware for years. :( For anyone that doesn't know about it, here's a forum thread about it they haven't deleted: https://forum.filezilla-project.org/viewtopic.php?t=50565 https://forum.filezilla-project.org/viewtopic.php?t=50565
can16358p 4y ago
Perhaps an optional small fee to be reviewed and "cleared" by a human reviewer (akin a blue checkmark) might be the nice middle ground (while you can still submit for free, but without an actual human clearing you "safe"). Of course it has its own problems like what happens an update is pushed, or something malicious in dependency tree and blue checkmark giving a false sense of security etc.
nine_k 4y ago
Small fees can't be the same for every country: say, what is small in the US is hefty in Kenya, and what is small in Kenya is negligible in the US.
- pipo234 4y ago
  ...And of course the miscreants will always find a way to pay as little as possible. Sad, but true, there is no easy solution - at least not a fair one, probably.
throw10920 4y ago
> Gets rid of anonymous spam. > I guess that's 98% of the problem. No, that's 99.99% of the problem. I've never even seen "bogus projects sponsored by wealthy companies" in volumes where it would be considered "spam". > What about abandonware? Grandfather in old projects. > And how do we remain open and inclusive to newbees? Everything is still open and inclusive - anyone can publish a repo on GitHub for free. Using a reputation system or a small fee for submission is a very reasonable means of controlling access to a centralized online repository.

justinclift 4y ago

> What to do about bogus projects sponsored by wealthy companies? Does this happen in the real world, rather than as a theoretical concern? As a thought, when a problem is pressing then sometimes it's best to start with a reasonable action then course correct over time. Rather than doing nothing waiting for a perfect solution.

mnw21cam 4y ago
> Does this happen in the real world, rather than be a theoretical concern? Heck yes. 99% of the stuff advertised to me in big money advertising campaigns is stuff that I will never want. If that doesn't count as "bogus projects sponsored by wealthy companies" then I don't know what does.
- mindcandy 4y ago
  In the real world, do wealthy companies want to be named on this list of 3 or 4 groups spamming NPM? That’s a lot different than being seen buying a banner ad.
  - pipo234 4y ago
    That's probably where the reputation part would come in - fair enough. Still, a large wealthy company might consider creating an "unaffiliated" front company to act on their behalf. For example, take out a legit open source competitor by having the front publish a mediocre bogus project with very similar name. Or paying a small fee to bundle malware into a legit FOSS. So, similar to Twitter's blue check mark - Yes, asking a "small fee" adds friction, but it's not an obstacle to the wealthy.
    - justinclift 4y ago
      Most of that seems _very_ theoretical, with the exception of "paying to bundle malware into legit FOSS". Unfortunately, that last one deserves a special Fuck You to the main developers of FileZilla, who have knowingly bundled malware for years. :( For anyone that doesn't know about it, here's a forum thread about it they haven't deleted: https://forum.filezilla-project.org/viewtopic.php?t=50565 https://forum.filezilla-project.org/viewtopic.php?t=50565

can16358p 4y ago

Perhaps an optional small fee to be reviewed and "cleared" by a human reviewer (akin a blue checkmark) might be the nice middle ground (while you can still submit for free, but without an actual human clearing you "safe"). Of course it has its own problems like what happens an update is pushed, or something malicious in dependency tree and blue checkmark giving a false sense of security etc.

nine_k 4y ago

Small fees can't be the same for every country: say, what is small in the US is hefty in Kenya, and what is small in Kenya is negligible in the US.

pipo234 4y ago
...And of course the miscreants will always find a way to pay as little as possible. Sad, but true, there is no easy solution - at least not a fair one, probably.

throw10920 4y ago

> Gets rid of anonymous spam. > I guess that's 98% of the problem. No, that's 99.99% of the problem. I've never even seen "bogus projects sponsored by wealthy companies" in volumes where it would be considered "spam". > What about abandonware? Grandfather in old projects. > And how do we remain open and inclusive to newbees? Everything is still open and inclusive - anyone can publish a repo on GitHub for free. Using a reputation system or a small fee for submission is a very reasonable means of controlling access to a centralized online repository.