Projects with bigger problems [LWN.net]

Projects with bigger problems

Posted Apr 30, 2026 13:48 UTC (Thu) by farnz (subscriber, #17727)
In reply to: Projects with bigger problems by marcH
Parent article: Dependency-cooldown discussions warm up

Quite the opposite - you'll have the spam problem, which means that manual policing is not doable (since you're flooded by possible attacks), along with attackers going for every niche they can with libraries that have everything they depend upon vendored instead of credited, so that they can get the full payment, rather than letting the people they depend upon get some income.

to post comments

Projects with bigger problems

Posted Apr 30, 2026 14:34 UTC (Thu) by marcH (subscriber, #57642) [Link] (8 responses)

For money to be there you need users to give some and I still didn't get how you get a significant number of users with your scheme, sorry.

Projects with bigger problems

Posted Apr 30, 2026 14:48 UTC (Thu) by farnz (subscriber, #17727) [Link] (7 responses)

You just need to flood out the catalog with so many projects in each area of application that, while any single project doesn't get much money, anyone trying to find something useful in there is likely to pick up one of your projects, and not one that's honest.

This is also a problem in retail - if you search eBay, AliExpress, Amazon or other marketplace sites for something fairly generic (as opposed to something that has active trademark protection), you're quite likely to be overwhelmed by large numbers of apparently identical versions from lots of random companies that you don't recognise.

Projects with bigger problems

Posted Apr 30, 2026 17:33 UTC (Thu) by marcH (subscriber, #57642) [Link] (6 responses)

I have never seen anyone looking for software looking for "something generic". I really don't think this is how it works.

Projects with bigger problems

Posted Apr 30, 2026 17:37 UTC (Thu) by farnz (subscriber, #17727) [Link] (2 responses)

I see it all the time - you want a HTTPS client, or a WiFi manager, and unless you know the name of the project you want already, you search for a generic term like that. And those terms will be absolutely overloaded with automated spam options - unless you know already that cURL is your HTTPS client of choice, or that you want IWD to manage WiFi connections, you're going to be facing people flooding out the things you want.

Not to mention typosquatting and other attacks on the humans doing this - you think you're donating to cURL, but you're donating to cURI instead.

Projects with bigger problems

Posted Apr 30, 2026 17:46 UTC (Thu) by marcH (subscriber, #57642) [Link] (1 responses)

When people are overloaded with generic offers, they usually turn to stats, reviews and other reputation systems and for software that is more than enough, you just need to invest more than a few minutes.

I think you also keep losing sight that we are discussing _voluntary_ contributions to... projects randomly picked up in a list? I'm not saying this would never happen, I'm just saying it will be small enough not to harm the system as a whole. Same for typosquatting.

For a bad actor typosquatting, security and owning target systems is probably more valuable than collecting contribution pennies.

Projects with bigger problems

Posted Apr 30, 2026 18:02 UTC (Thu) by farnz (subscriber, #17727) [Link]

Right, and what I'm saying is that the system will not work, because as soon as there's money in the system, people will game stats, reviews, reputation systems, and more.

As a result, either you have no contributions (hence no money, hence no attackers), or you're faced with a flood of attackers making the system more expensive to run. The only reason Temu and places like it survive is that, with a flood of attackers, you still have people who have to pay to get the goods at all; but if I don't have to pay, why would I risk paying on a platform that's full of scams?

Projects with bigger problems

Posted Apr 30, 2026 17:42 UTC (Thu) by pizza (subscriber, #46) [Link] (2 responses)

> I have never seen anyone looking for software looking for "something generic". I really don't think this is how it works.

Even if there is only one module in the entire namespace that implements $functionality, how exactly are random software developers supposed to know what its name is without first searching for "$language module for $functionality" ?

Projects with bigger problems

Posted Apr 30, 2026 17:54 UTC (Thu) by marcH (subscriber, #57642) [Link] (1 responses)

I meant no one looking for software is going to think "Oh, I can choose between 50 'generic' options for this, I'm spoiled with choice, this is great! Lucky me".

Software being all fixed costs and network effects, when you see 50 different options you immediately know that at least 47 are garbage if not more. Once you have 3 viable left, you are still depressed because now you need even more time to evaluate the 3 left, as you know dependencies are really hard to change and picking up one is pretty long-term commitment.

This is pretty much the opposite of buying "generic" stuff on Temu.

Projects with bigger problems

Posted Apr 30, 2026 17:59 UTC (Thu) by farnz (subscriber, #17727) [Link]

No, they're going to think "oh, this platform is awful - it's got 5,000 options, and I can't see how I find the legitimate ones in all the junk, so I'm not going to donate to anything on this platform at all". And thus, the platform ends up dead.