Post

This feature seems to be a bit buggy. When I opened the page -> npmx.dev/package/svelte a few minutes ago it showed 20 likes. Then I logged in and liked it -> 21 likes. Then I checked with another browser (no login) -> 17 likes. Then I hard reload all pages in all browsers -> 14 likes. 🤔

Thinking about this, I also wonder how spam resistant this feature is. E.g. a rogue PDS (or fleet of PDS) sending a few hundred/thousand fake accounts with like records/events out. Of course this is also possible and happening in e.g. GitHub, but maybe at a different scale (relative).

0 reposts3 likes

If done right this spam attack will be way below what rate limits enforce and probably also below other automated spam detection mechanisms, as it takes only a comparable very small amount of likes to majorly skew this metric.

Also small update to OG problem: There is a bit of a lag/cache issue. Liking and removing a like seems to work as advertised at least from the PDS point of view (records get created/removed). But the website "jumps" back and forth showing those likes, e.g. a fresh like gets reset and vice versa.

There's sooo much more that can be done with a social graph. I wrote an npm trust graph PoC once github.com/naugtur/trus... And here's some more on trust graphs and why Eigen Trust might be unnecessary bsky.app/profile/rekm...

github.comGitHub - naugtur/trust-graph: Trust graph implementation for npm package vulnerability and maintenance.Trust graph implementation for npm package vulnerability and maintenance. - naugtur/trust-graph
Erik@rekmarks.com

Wherein we disparage EigenTrust and point to a smaller yet more powerful alternative: rekmarks.com/posts/modeli...

Any reason npm's native stars weren't used? ie. `npm star <pkg>` / `npm stars <user>` - this count is already available/shows up in Packuments under the top-level key "users" & is tied to npm accounts (so secondary inference/insights are trivial)