Post

17 likes!? ❤️ Is @svelte.dev the most liked package on npmx right now?

This feature seems to be a bit buggy. When I opened the page -> npmx.dev/package/svelte a few minutes ago it showed 20 likes. Then I logged in and liked it -> 21 likes. Then I checked with another browser (no login) -> 17 likes. Then I hard reload all pages in all browsers -> 14 likes. 🤔

@baileytownsend.dev this is what you get for getting the atproto network to try out pre-alpha features

Thinking about this, I also wonder how spam resistant this feature is. E.g. a rogue PDS (or fleet of PDS) sending a few hundred/thousand fake accounts with like records/events out. Of course this is also possible and happening in e.g. GitHub, but maybe at a different scale (relative).

If done right this spam attack will be way below what rate limits enforce and probably also below other automated spam detection mechanisms, as it takes only a comparable very small amount of likes to majorly skew this metric.

IMO ultimately we should leverage the social graph to validate the likes liked by <x> people you follow

There's sooo much more that can be done with a social graph. I wrote an npm trust graph PoC once github.com/naugtur/trus... And here's some more on trust graphs and why Eigen Trust might be unnecessary bsky.app/profile/rekm...

The difficulty is bootstrapping the graph. Maybe bluesky could be that

That is exactly what Bluesky / atproto is. The kind of web of trust algorithm I describe in that blog post is made practically feasible by atproto.

You can't just naively use follows, because follows do not necessarily imply trust, but it would be straightforward to present a UI that's like "choose people to trust from your follows".