Prevent uploading empty templates

[miyoyo]

https://pub.dartlang.org/packages/hello_plugin
https://pub.dartlang.org/packages/hello
https://pub.dartlang.org/packages/flutter_plugin_test
https://pub.dartlang.org/packages/test_flutter_plugin
https://pub.dartlang.org/packages/felix_plugin_demo
https://pub.dartlang.org/packages/hello_hello
https://pub.dartlang.org/packages/first_plugin
https://pub.dartlang.org/packages/libvia

All of these are completely devoid of any useful code, as they are mere templates.
Preventing the upload of empty templates will help reduce the package spam on pub.

[isoos]

Closely related to #1570.

[GroovinChip]

I've got a few more of these:
https://pub.dartlang.org/packages/number_display
https://pub.dartlang.org/packages/rvengine
https://pub.dartlang.org/packages/helper
https://pub.dartlang.org/packages/timer_button_sreeraj
https://pub.dartlang.org/packages/flutter_paudio
https://pub.dartlang.org/packages/flutter_collapsible_toolbar
https://pub.dartlang.org/packages/flutter_collapsable_toolbar
https://pub.dartlang.org/packages/carousel_hero
https://pub.dartlang.org/packages/redux_sqlite

These have all been published between Feb 1 and now

[jonasfj]

hmm, maybe it's better to come up with a moderation policy..

And if you find a nice package name squatted, you ask the uploader for ownership, or file a request to take ownership under given moderation policy.

@mit-mit, are you working on a package moderation policy?

[GroovinChip]

https://pub.dartlang.org/packages/hello_private

WHY

[isoos]

Pushing this back in priorities.

We'd like to have a voting/rating/feedback feature implemented first (#798), and we could use that for moderating such packages after the upload.

Pana could detect if the readme is from template (dart-lang/pana#129), but in such cases the package is unmaintained anyway, and the uploader likely does not care about it.

One tangent that may be worth to pursue in the short term: checking the homepage URL at the time of the upload, but arbitrary blocking that seems to just encourage entering random third-party sites. THe list above already has package with www.google.com as a homepage.

[thumbert]

https://pub.dev/packages/seeyou_service
https://pub.dev/packages/ganesh_library
https://pub.dev/packages/dart1
https://pub.dev/packages/sample
https://pub.dev/packages/first_library
https://pub.dev/packages/first_dart_library
https://pub.dev/packages/dartlibraries
https://pub.dev/packages/madhav_dart
https://pub.dev/packages/dart_binary
https://pub.dev/packages/sample_demo
https://pub.dev/packages/anukeerthi_library
https://pub.dev/packages/raj_learn_bubblesort
https://pub.dev/packages/learning_to_publish
https://pub.dev/packages/dart_library

[miyoyo]

An entire page, filled with subsequent empty/test packages that have had almost zero work put into them (likely following a tutorial)

https://pub.dev/packages/demo // This one literally has no code inside of it
https://pub.dev/packages/pinpackage
https://pub.dev/packages/santhoshi_library
https://pub.dev/packages/dart_library
https://pub.dev/packages/cm_test_plugin_package
https://pub.dev/packages/test_cm_dev_package
https://pub.dev/packages/flutter_package_test_1
https://pub.dev/packages/flutter_package_test_2
https://pub.dev/packages/bugly_ios
https://pub.dev/packages/hellowsh123
https://pub.dev/packages/flutter_package_1
https://pub.dev/packages/dart_dir_new
https://pub.dev/packages/flutter_bugly_ios
https://pub.dev/packages/hell_package
https://pub.dev/packages/flutter_metadata
https://pub.dev/packages/youban_clock

// Edit 24 June

It just keeeeeeps pilin' on.
https://pub.dev/packages/dart1
https://pub.dev/packages/wq
https://pub.dev/packages/login_package // This is a flutter app, how.
https://pub.dev/packages/wq2
https://pub.dev/packages/new_library
https://pub.dev/packages/andoter_flutter
https://pub.dev/packages/test_lib_hait

// Edit 30 June: 👏 LESS 👏 TRASH edition

https://pub.dev/packages/search_api_yash
https://pub.dev/packages/main // I'll give you a tip: The title is actually accurate for once!

[miyoyo]

Because the previous post is getting way too long, I'll use a new one for this special edition: a blast from the past!... which means I've just gone to the last page and worked my way up till the first libraries I posted up there. Still, around 100!

https://pub.dev/packages/codenames_board
https://pub.dev/packages/tree
https://pub.dev/packages/prompter_mrm
https://pub.dev/packages/code_health_meta
https://pub.dev/packages/rua
https://pub.dev/packages/ruax
https://pub.dev/packages/inversify
https://pub.dev/packages/exp_lib
https://pub.dev/packages/qiniu_sdk
https://pub.dev/packages/atom
https://pub.dev/packages/nice_dart_lib
https://pub.dev/packages/pug
https://pub.dev/packages/tennessine
https://pub.dev/packages/my_batt_level_kotlin_swift
https://pub.dev/packages/flutter_validator
https://pub.dev/packages/testpackageravi
https://pub.dev/packages/aesth
https://pub.dev/packages/flutter_env
https://pub.dev/packages/awesome_theme
https://pub.dev/packages/rely
https://pub.dev/packages/flutter_here_maps
https://pub.dev/packages/primer
https://pub.dev/packages/hello_margin_test
https://pub.dev/packages/fh_pub_test
https://pub.dev/packages/pinpackage
https://pub.dev/packages/signalr
https://pub.dev/packages/utilities_flutter
https://pub.dev/packages/flutter_elements
https://pub.dev/packages/zoomable
https://pub.dev/packages/fui
https://pub.dev/packages/test_packages
https://pub.dev/packages/sogouloan_dio
https://pub.dev/packages/flutter_plugin_sample
https://pub.dev/packages/ulti_plugin
https://pub.dev/packages/package_test // I doubt those were
https://pub.dev/packages/testhaipham // made by the flutter team
https://pub.dev/packages/core_plugins
https://pub.dev/packages/ignore_barometer // Yes, I know, it's from the flutter team, but it's still completely broken
https://pub.dev/packages/ignore_barometer_bad // Ironically has a better score than the previous one
https://pub.dev/packages/read_qr_gallery
https://pub.dev/packages/native_brige
https://pub.dev/packages/flutter_plugin_youtubeplayer
https://pub.dev/packages/fluqq
https://pub.dev/packages/yzk_flutter_plugin
https://pub.dev/packages/flutter_mob
https://pub.dev/packages/flutter_show_toast_sk
https://pub.dev/packages/fluchar
https://pub.dev/packages/flutter_xiaowen_plugin
https://pub.dev/packages/stripe_card_input
https://pub.dev/packages/cmcm_plugin
https://pub.dev/packages/sum_up_plugin
https://pub.dev/packages/amazonfiretvcast
https://pub.dev/packages/flutter_googlefit
https://pub.dev/packages/plugin1
https://pub.dev/packages/testpluginsravi
https://pub.dev/packages/upetch_razor_pay_plugin
https://pub.dev/packages/youme
https://pub.dev/packages/phone_status
https://pub.dev/packages/sweatybenny
https://pub.dev/packages/flutter_ioshttp
https://pub.dev/packages/upetch_paysquare_service
https://pub.dev/packages/flutter_fs
https://pub.dev/packages/mob_test1
https://pub.dev/packages/nhh_apis
https://pub.dev/packages/my_plugin
https://pub.dev/packages/flutterkt_plugin
https://pub.dev/packages/local_camera
https://pub.dev/packages/flutter_plugin_information
https://pub.dev/packages/mobverify
https://pub.dev/packages/mob_share
https://pub.dev/packages/add_contact_plugin
https://pub.dev/packages/battery_vajra
https://pub.dev/packages/flutter_plugins
https://pub.dev/packages/cmspeechrecognition
https://pub.dev/packages/fluwx_test
https://pub.dev/packages/zhn_scan
https://pub.dev/packages/flutter_sms_retriever
https://pub.dev/packages/mmsmsretriever
https://pub.dev/packages/flutter_toast_dn
https://pub.dev/packages/dn_plugin
https://pub.dev/packages/uptime_x
https://pub.dev/packages/flutter_plugin1
https://pub.dev/packages/leleping
https://pub.dev/packages/x_view
https://pub.dev/packages/flutter_hello_plugin
https://pub.dev/packages/zyl_test_plugin
https://pub.dev/packages/tralala
https://pub.dev/packages/camerademo
https://pub.dev/packages/wenyuan_plugin_demo
https://pub.dev/packages/flutter_plugin2
https://pub.dev/packages/gesture_unlock
https://pub.dev/packages/dqd_plugin
https://pub.dev/packages/flutter_plugin_zmoa_test
https://pub.dev/packages/helloxxoxxoo
https://pub.dev/packages/ynm
https://pub.dev/packages/flutter_plugin_demo
https://pub.dev/packages/join_qq
https://pub.dev/packages/dechao_hello
https://pub.dev/packages/barometer_test
https://pub.dev/packages/youban_clock
https://pub.dev/packages/yui_flutter
https://pub.dev/packages/flutter_metadata

[jonasfj]

Any good ideas for how to automatically detect packages that are essentially just templates?

We could easily forbid them at upload, if we can easily determine whether they are useful or not..

[miyoyo]

I think that a few steps could be taken to prevent such things from happening:

• DENY uploading if the package's description is a default description

const defaultDesc = <String, String>{
  "A new Flutter project.": "flutter project",
  "A new flutter plugin project.": "flutter plugin",
  "A new flutter package project.": "flutter package",
  "An app built using Flutter for web": "stagehand flutter-web-preview",
  "A sample command-line application.": "stagehand console-full",
  "A starting point for Dart libraries or applications.":
      "stagehand package-simple",
  "A web server built using the shelf package.": "stagehand server-shelf",
  "A web app that uses AngularDart Components": "stagehand web-angular",
  "An absolute bare-bones web app.": "stagehand web-simple",
  "A simple StageXL web app.": "stagehand web-stagexl",
  "Have you been turned into a newt?  "
      "Would you like to be? This package can help. "
      "It has all of the newt-transmogrification functionality "
      "you have been looking for.": "dart pubspec example",
};

• DENY uploading if the package's source is exactly the same as defaults
  • maybe parse the source and see if it's equivalent to the default examples?
• DENY uploading if the package's homepage points to an "illegal" domain

const invalidHomepages = <String>[
  "https://github.com/dart-lang/usage",
  "https://example-pet-store.com/newtify",
  "https://www.google.com"
];

• DENY uploading the package if Pana scores too low
  • The errors should be clear and explicit
• WARN if the Readme is the default one, heavily penalize pana score (-5 at least) if it is the default one.

Maybe import package pedantic if the package is pushed to pub?

And finally, allow retraction of packages within a certain time frame, and/or if the package hasn't been depended on in X days. (I know the pub team isn't big on package unpublishing)

And of course, moderation could also be a solution, but then, it gets into the territory of "who is the authority on packages?"
But that could be solved using democratic processes and package scores.

What if, if the package score was under 50 or something, and a (not yet existing, #798 ) user rating is too low, the package could be vote-deleted? Of course, new packages would be protected from this process, that way, they have a fair window to fix issues and gain popularity before being at risk of deletion.

Here are examples of what a bad package would look like, vs a good package:

[pingbird]

Besides the blatant sample projects, are there any packages on pub.dev that don't have a default description / README but are so trivial that it would be worth moderating? i.e. https://www.npmjs.com/package/is-even

[amugofjava]

What about filtering out low scoring packages from any search results on pub.dev (at least by default)? Whilst not removing or preventing the packages from existing, it would at least reduce the clutter from search results. As I understand it, scores on pub gradually reduce for packages that are un-used or-un-maintained. These may then also end up below the threshold and disappear from search results. Going forward, automated emails could be sent out to maintainers for packages that have not been updated or ever used and eventually purged.