Hacker News Reader

Hacker News

Comment by miohtama | Hacker News Reader

Full thread

miohtama

Spam problems can be solved by

- Cross-Internet reputation system for accounts

- Small fee on submission

View on HN

> Small fee on submission

This will immediately bias the submissions only coming in from the west. Remember you can make the fee small but sometimes a person can't even pay even if they have the money. I remember having the 1000 or so rupees required for some VPS stuff when I was a teenager and not being able to pay since I didn't have a credit card. I hope we don't ever make money a barrier to open source.

Are people who submit to NPM really that short on cash?

I doubt it.

Please thoroughly read the comment you are replying to.

A lot of counties (like mine) don't have access to global payments. Having a card in Euro or USD requires special paperwork.

From my experience cryptocurrencies are helping countries overcome that. But still, money wouldn't be a solution for this issue.

You'd have to get cryptocoins in the first place, and there are countries which ban all kinds of cryptocurrency (China) or place it behind onerous KYC requirements (EU, US).

Do you mind if I ask what country?

Tunisia

Having cash and having means to spend that cash online while living in a random country are two very different things.

It's easy to get a Visa/Mastercard in the US. It gets a bit trickier in some EU countries. Then the further from the west you go, the more complicated it gets, all the way down to impossible if you live in a place that the US isn't on friendly terms with (like Iran or Russia).

If you auto-assume everyone can pay any amount online (even if it's a refundable $1 for verification purposes), you're gonna cut off access to a lot of people unintentionally, while only raising the bar a little bit for spammers.

If only there were some kind of decentralized digital currency a person could use outside of big banks and credit cards..

Dude I couldn't get a credit card in India, do you think a young person can easily get bitcoin? Its not that I was banned from getting it, its just that I couldn't afford it and getting it was really hard. Getting bitcoin, starting from fiat, is equally hard.

Woa woa, I never said bitcoin. I would never bring it up on HN, that's a recipe for downvotes.

You are not being as clever as you think you are.

[Clown emoji]

> I hope we don't ever make money a barrier to open source.

Then make some other very cumbersome proof. But it's still better to cut off half the world from open source than pollute the few large software repositories with spam, which would dissuade everyone everywhere from contributing eventually. There's no problem contributing to a library from anywhere it's just that you collaborate with someone who in turn can pay the reg/anti-spam fee.

I don't understand this obsession with solving everything with money. It doesn't event solve this problem, just because someone payed the fee doesn't mean their code is not spam. You can't keep the fee small enough and still dissuade spammers.

You can do reputation, or money, or some "proof of work". Or you can do all of them. But money is by far the easiest one to implement. You could e.g. either require the votes of 3 separate maintainers of packages totaling 100k downloads in order to upload a new package, or you could have a $10 fee.

The reason money is natural is because there is a cost associated with manually vetting all packages.

Everything is easy if all you care about the KPIs your system performs well in. Making any system with money is easy if you don't care about equality or fairness.

> - Cross-Internet reputation system for accounts

Gets rid of anonymous spam.

> - Small fee on submission

Gets rid of amateur spam.

I guess that's 98% of the problem. I think this is a good start.

What to do about bogus projects sponsored by wealthy companies? What about abandonware? And how do we remain open and inclusive to newbees?

> What to do about bogus projects sponsored by wealthy companies?

Does this happen in the real world, rather than as a theoretical concern?

As a thought, when a problem is pressing then sometimes it's best to start with a reasonable action then course correct over time. Rather than doing nothing waiting for a perfect solution.

> Does this happen in the real world, rather than be a theoretical concern?

Heck yes. 99% of the stuff advertised to me in big money advertising campaigns is stuff that I will never want. If that doesn't count as "bogus projects sponsored by wealthy companies" then I don't know what does.

In the real world, do wealthy companies want to be named on this list of 3 or 4 groups spamming NPM? That’s a lot different than being seen buying a banner ad.

That's probably where the reputation part would come in - fair enough. Still, a large wealthy company might consider creating an "unaffiliated" front company to act on their behalf. For example, take out a legit open source competitor by having the front publish a mediocre bogus project with very similar name. Or paying a small fee to bundle malware into a legit FOSS.

So, similar to Twitter's blue check mark - Yes, asking a "small fee" adds friction, but it's not an obstacle to the wealthy.

Most of that seems _very_ theoretical, with the exception of "paying to bundle malware into legit FOSS".

Unfortunately, that last one deserves a special Fuck You to the main developers of FileZilla, who have knowingly bundled malware for years. :(

For anyone that doesn't know about it, here's a forum thread about it they haven't deleted:

https://forum.filezilla-project.org/viewtopic.php?t=50565

Perhaps an optional small fee to be reviewed and "cleared" by a human reviewer (akin a blue checkmark) might be the nice middle ground (while you can still submit for free, but without an actual human clearing you "safe"). Of course it has its own problems like what happens an update is pushed, or something malicious in dependency tree and blue checkmark giving a false sense of security etc.

Small fees can't be the same for every country: say, what is small in the US is hefty in Kenya, and what is small in Kenya is negligible in the US.

...And of course the miscreants will always find a way to pay as little as possible. Sad, but true, there is no easy solution - at least not a fair one, probably.

> Gets rid of anonymous spam.

> I guess that's 98% of the problem.

No, that's 99.99% of the problem. I've never even seen "bogus projects sponsored by wealthy companies" in volumes where it would be considered "spam".

> What about abandonware?

Grandfather in old projects.

> And how do we remain open and inclusive to newbees?

Everything is still open and inclusive - anyone can publish a repo on GitHub for free. Using a reputation system or a small fee for submission is a very reasonable means of controlling access to a centralized online repository.

This old gem comes to mind in any conversation about how to alleviate spam problems: https://craphound.com/spamsolutions.txt

I don’t see anybody paying to submit a package to a registry. Even if NPM didn’t support other registries or direct installs from a versioning system, different tools would have been created by the community.

Captcha is an alternative to small fee, cause solving it automatically costs money.

Real fee will scare away almost all amateur developers and almost all professional developers who don’t already have a business account available.

I run a big web property with great SEO ranking, and captcha definitely does not deter the spam. A lot of this spam is posted by actual humans.

Clearly, captcha only works in the same budget category. If that spam “business” endures hiring humans, it will easily swallow small fees too.

The fee structure is the most interesting in my perspective. It would be interesting to see how an open source platform could combat this with a gas-fee structure using their own token economy. You'd need to get tokens to submit, which you can get by donations by engaging with a community, or by buying them, etc.

Small fee to submit open-source packages?

Ie.: Open source = free as in speech, and cheap as in beer ;-)

sounds like twitter's new strategy

It's a good strategy. Suddenly spam costs money.

Does spam costing more money stop spam? Does it cost money per account, project, version? If I can make $100 from one victim, is this spam still profitable?

What happens to the international developers who cannot easily get a payment method setup?

Does a $10/m "identity verification" stop a nation state from using the platform to influence?

Fair argument. The spam fee should be proportional to the amount of spam rather than account or fixed monthly fee. Some kind of micropayment per spam item. Per repo, or per commit / per release in case of NPM?

Micropayments on internet have always proven difficult to implement. No silver bullets.

When there's so much spam, there's a cost to everyone.

Just like things work in scientific publishing I guess

So, terribly?

NPM for companies costs enough that it surely covers all the reviews already.

It’s not about revenue, it’s about making spam unprofitable. Charging 0.25$usd is enough to make spam not worth it.

It also attaches an identity to the posting.

I think the suggestion was that the revenue generated by NPM's commercial dealings should cover any cost associated with a review process for OSS submissions (which in itself would make such spam repositories ineffective)

So, let the spam happen, and remove it after the fact using humans? Or hold all submissions until a human reviews it?

I'm just clarifying my interpretation of OP's comment, not necessarily agreeing with it.

Anyway, involving humans (funded by NPM's commercial revenue) doesn't reduce the options to "letting the spam happen and dealing it after the fact" or "holding all submissions until a human reviews [them]".

If I was trying to solve this problem, I'd be open to a solution that tried to automatically classify submissions as either legitimate or spammy, with an associated confidence level. If the confidence level fell below a given threshold then I'd involve a human.

Yes, the first one. Not exclusively with using humans to develop better detection of spam.

Do you have an example for cross-community reviews?

Essentially this is what academic journals are doing.

Every paper should be reviewed manually. Of course that costs some money (although the reviewers aren’t paid).

And they often barely validate the actual work, many times passing it on to subordinates.

Stackoverflow does that. As a regular user you can contribute by reviewing q&as from a special queue, it’s next to your username+score div.

https://www.google.com/search?q=stackoverflow+review+queue&t...

The fees are in the wrong direction. Submitters of good npm packages should be paid.

(The overall lack of quality control on npm is a separate question)

Package managers have a hard enough time managing packages. Imagine them having to manage payments...

A small fee on package creation/account creation would be better.

- Abolishing capitalism

Wait, I may have been overdoing it with root cause analysis again.

Reply on news.ycombinator.com