Spam extensions on the Marketplace #343

prashantvc · 2022-03-07T07:40:37Z

prashantvc
Mar 7, 2022

We are seeing high number of spam extensions in the marketplace. The team is actively working on preventing these spam extensions.

Meantime you may experience service degradation

We appreciate your patience ❤️

zimmski · 2022-03-10T11:48:45Z

zimmski
Mar 10, 2022

Can you please elaborate on what a "spam extension" is? We opened #346 because the README did not change. We have publishing a new version in our CI. So it can happen that the README is changed multiple times a day. Is that maybe spam already?

1 reply

ssbarnea Mar 10, 2022

There is another issue related to nature-spamming (not deliberate one). As vast majority of extensions are released by individuals, from theirs own github accounts it is likely that after a number of months or years they become abandonware.

As most of them are open source, forking, changing the name and releasing again is a common practice. I even seen caused with a chain of 8-10 extensions.

vscode-marketplace team has it own contribution on this because the ability to mark an extension as abandoned was never implemented. The focus was to brag about how many extensions there are. The reality is that more is less in that case. All leftovers do devalue the entire marketplace as it makes much harder to spot the active ones.

Microsoft could persuade people to join efforts when developing extensions, like promoting extensions that do come from organizations (github ones, not corporations) and that have more than one maintainer. Any project that has more than one maintainer is far more likely to resist the test of time. You don't really need to organize people for this but setting some guidelines and distinguishing between one-man-extension and community backed ones could be enough to prevent explosion of forked extensions.

I based my statement on what happened related to Ansible extensions, where I spent the last 1+ year contacting authors or older extensions and convincing them to team-up and work on maintaining a single Ansible extension. It required some time but I am pleased about the result as most of these outdated extensions were unpublished by now.

A certification program could be another way to distinguish between low and high quality extensions but that is clearly something that needs considerably more effort.

PS. I happened that few months back I wrote, over a weekend, an extension that does only uninstall known outdated or broken extensions: https://marketplace.visualstudio.com/items?itemName=42picky.octarine -- I was about to call it the "uninstaller" but decided to go for something else, in case other features will be added after.