95% of PHPixie Installs on Packagist Are Fraudulent | Hacker News Reader

95% of PHPixie Installs on Packagist Are Fraudulent

andrewcarteruk.github.io

82 pointsDachande66339 comments

I'm not surprised, the author been spamming reddit about his framework for years. He has a really bad reputation in /r/PHP. At the same time I've never seen any projects using this framework.

The subsequent Reddit thread did not help PHPixie's credibility: https://www.reddit.com/r/PHP/comments/4iju97/95_of_phpixie_i...

Not too surprising. PHPixie spams /r/php like crazy. Trying to ride the huge success that Laravel has experienced except they are skipping the steps of having a solid product or a strong community.

There's large-scale fraud by the Apache Groovy ecosystem also. Downloads from the Bintray repository mostly come as redirects from the groovy-lang.org website hosted somewhere in Germany, and the owner of that domain has a history of fabricating download numbers and gaming popularity rankings, so I suspect the "over 1 million downloads a month" claim is similarly fraudulent, though by what degree is anyone's guess.

Thanks, this is interesting as a long-time Groovy user (who currently adapts Kotlin). I've found this [1].

[1] http://gavingroovygrover.tumblr.com/post/131337969066/groovy...

I don't follow the PHP crowd but this is... I don't know. An ego play for this individual? I'm trying to figure out what he has to gain other than a pat on the back.

He's allegedly inflated his usage numbers in order to secure/sustain membership in the PHP-FIG. There are several high-profile projects in the group, so I imagine getting your project listed as a member adds some prestige and is good for resume building.

PHP-FIG: http://www.php-fig.org/

IF all his fun and games worked he could have owned a popular framework, sometimes that works out to be very valuable. Lots of people and companies have considered that enough justification to shill HN in the past.

Some developers really do want to be rockstars, I suppose.

I wonder how much this happens in other communities. No doubt it happens with NPM.

Certainly the docker repositories are vulnerable to this. If you look at a users' profile page you can see the download-count for each image.

The biggest download count becomes the most popular image, and you can script it trivially:

    docker pull skxskx/wordpress
    docker pull skxskx/wordpress
    ..
    docker pull skxskx/wordpress

It's not something that I regard as a problem, but I did notice in passing and added 50 downloads to a few of my images on evening to test the concept.

> No doubt it happens with NPM.

Could you please care to explain why?

Because NPM is the largest package ecosystem ever

The Java community became familiar with the term 'astroturfing' after JBoss was caught doing it.

Rot in hell, Marc Fleury

I'd have less doubt, if I were to see some examples...

Urgh, when did PHP become Java? https://github.com/PHPixie/ORM/blob/master/src/PHPixie/ORM/B...

Well, PHPixie is using a dirty trick right out of the JBoss playbook, so that's two strikes...

PHPixie plus G-WAN seems like a perfect (sociological) match.

Reply on news.ycombinator.com