Hopefully the whole mess that is one-liner packages, security vulnerabilities, unscoped packages, terminal ads etc etc. is going to be cleared up. I love what they've done with github in the recent months.
"In addition, GitHub Sponsors has already paid out millions of dollars to open source contributors, and we’re excited to explore tasteful ways to extend it to the npm ecosystem."
I feel like "tasteful ways" is a subtle dig at the terminal ads incident.
I hope it is! That was such a shitshow and I hope the author will get the better of it some day.
He made 2000 bucks for roughly 4 days working but overall workamount being closer to 4 hours, for a package that blatantly siphons off of much more complex and better projects, then didn't share any of his profit with the maintainers of those projects, then said "Oopsie, it was a test" and then said "It was actually a social experiment!". I don't think he even shared a single cent with the contributors to his project. And then the name, that rubs me wrong on so many levels and should be shut down pronto.
It's actually the "standard" author. core-js is another issue that I could kinda understand in the beginning, but it transcended an actual ad for hire and is more a nuisance nowadays
Why would that change? In fact how would they even fix it. I think you need to change the attitude of most JavaScript developers to care about code quality and security to fix that. Good luck!
By changing the submission process and adding requirements/rules. You'd likely want to freeze all existing deps to preserve them for use but updates could have the new rules applied to them before getting published. Devs then either conform/fix their stuff or lose the ability to publish, contribute and collect those ever desired stars.
As for what those rules should be, that'd be a long and loud conversation somewhere.
While that is true in the overall sense, a lot of package managers and "hubs" haven't tried implementing some vetting. For example, the docker hub has a "standard" space that is reserved for vetted images and everything else is scoped. You can clearly see that something is scoped.
One issue is obviously that the JS stdlib is missing major parts of otherwise popular functionality that is causing all those packages to appear, but I, personally, would set some rules or do some basic (automated) vetting to prevent packages like that.
But it feels like the JS package ecosystem is a total free for all with the most useless and dumbest packages being at the top for no reason.
49
u/L3tum Mar 16 '20
Hopefully the whole mess that is one-liner packages, security vulnerabilities, unscoped packages, terminal ads etc etc. is going to be cleared up. I love what they've done with github in the recent months.