Post

17 likes!? ❤️ Is @svelte.dev the most liked package on npmx right now?

This feature seems to be a bit buggy. When I opened the page -> npmx.dev/package/svelte a few minutes ago it showed 20 likes. Then I logged in and liked it -> 21 likes. Then I checked with another browser (no login) -> 17 likes. Then I hard reload all pages in all browsers -> 14 likes. 🤔

@baileytownsend.dev this is what you get for getting the atproto network to try out pre-alpha features

Thinking about this, I also wonder how spam resistant this feature is. E.g. a rogue PDS (or fleet of PDS) sending a few hundred/thousand fake accounts with like records/events out. Of course this is also possible and happening in e.g. GitHub, but maybe at a different scale (relative).

If done right this spam attack will be way below what rate limits enforce and probably also below other automated spam detection mechanisms, as it takes only a comparable very small amount of likes to majorly skew this metric.

That would also be a novel thing which GitHub etc do not offer.

Also small update to OG problem: There is a bit of a lag/cache issue. Liking and removing a like seems to work as advertised at least from the PDS point of view (records get created/removed). But the website "jumps" back and forth showing those likes, e.g. a fresh like gets reset and vice versa.

The red indicator if the like is present on the PDS works correctly, this "jitter" only affects the shown like count. I know it's alpha and just a day old etc :)

There's sooo much more that can be done with a social graph. I wrote an npm trust graph PoC once github.com/naugtur/trus... And here's some more on trust graphs and why Eigen Trust might be unnecessary bsky.app/profile/rekm...

The difficulty is bootstrapping the graph. Maybe bluesky could be that

That is exactly what Bluesky / atproto is. The kind of web of trust algorithm I describe in that blog post is made practically feasible by atproto.

Any reason npm's native stars weren't used? ie. `npm star <pkg>` / `npm stars <user>` - this count is already available/shows up in Packuments under the top-level key "users" & is tied to npm accounts (so secondary inference/insights are trivial)

in honesty i had never heard of or seen an npm star 🤦‍♂️

Yea... this was/is a thing. It was "removed" on the website at some point before I joined. That said, you can still find references in the website to it (since it was only visually removed) & the endpoints / CLI commands still exist & work.