Post

17 likes!? ❤️ Is @svelte.dev the most liked package on npmx right now?

This feature seems to be a bit buggy. When I opened the page -> npmx.dev/package/svelte a few minutes ago it showed 20 likes. Then I logged in and liked it -> 21 likes. Then I checked with another browser (no login) -> 17 likes. Then I hard reload all pages in all browsers -> 14 likes. 🤔

@baileytownsend.dev this is what you get for getting the atproto network to try out pre-alpha features

Thinking about this, I also wonder how spam resistant this feature is. E.g. a rogue PDS (or fleet of PDS) sending a few hundred/thousand fake accounts with like records/events out. Of course this is also possible and happening in e.g. GitHub, but maybe at a different scale (relative).

If done right this spam attack will be way below what rate limits enforce and probably also below other automated spam detection mechanisms, as it takes only a comparable very small amount of likes to majorly skew this metric.

IMO ultimately we should leverage the social graph to validate the likes liked by <x> people you follow

There's sooo much more that can be done with a social graph. I wrote an npm trust graph PoC once github.com/naugtur/trus... And here's some more on trust graphs and why Eigen Trust might be unnecessary bsky.app/profile/rekm...

The difficulty is bootstrapping the graph. Maybe bluesky could be that

You can't just naively use follows, because follows do not necessarily imply trust, but it would be straightforward to present a UI that's like "choose people to trust from your follows".

Inherently sybil-resistant. And you can (and should) just not display the raw likes at all. For unauthenticated users you could display the likes based a set of trusted accounts that @npmx.dev has chosen.