Security News
pnpm 10.0.0 Blocks Lifecycle Scripts by Default
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
appleseed-metric
Advanced tools
appleseed-metric
Appleseed is a trust propagation algorithm and trust metric for local group trust computation. It was first described by Cai-Nicolas Ziegler and Georg Lausen in Propagation Models for Trust and Distrust in Social Networks.
Basically, Appleseed makes it possible to take a group of nodes—which have various trust relations to each other—look at the group from the perspective of a single node, and rank each of the other nodes according to how trusted they are from the perspective of the single node.
Appleseed is used by TrustNet, a system for interacting with and managing computational trust.
For more details, see Chapter 6 of the TrustNet report by Alexander Cobleigh. The report contains a full walkthrough of the original algorithm's pseudocode, a legend over all of the variables, and water-based analogy for understanding the otherwise abstract algorithm (and illustrations!) You may also be interested in reading the blog article introducing TrustNet.
const appleseed = require("appleseed-metric")
const trustAssignments = []
trustAssignments.push({ src: 'a', dst: 'b', weight: 0.80 })
trustAssignments.push({ src: 'a', dst: 'c', weight: 0.80 })
trustAssignments.push({ src: 'b', dst: 'd', weight: 0.80 })
trustAssignments.push({ src: 'x', dst: 'y', weight: 0.80 })
const source = "a"
appleseed(source, trustAssignments, 200, 0.85, 0.01).then((result) => {
console.log(`converged in ${result.iteration} iterations`)
console.log(result.rankings) // won't contain x or y, as they are unconnected to a.
// b, c, and d will have numerical rankings assigned to them
})
const appleseed = require("appleseed-metric")
Returns a promise. which resolves into a object of id
-> rank
mappings. The promise is resolved when the algorithm has converged, and all the trust ranks have been determined, as seen from the connected graph emanating outwards from source
.
rankings
Object mapping an identifier from a src
or dst
field in trustAssignments
to its found trust ranking, which is a float.graph
The trust graph, discovered by traversing trustAssignments
from the starting point source
iterations
The number of iterations required before convergence. Normally around 50-70 iterations.source
The trust source whose trust graph we are traversing to determine trust ranks.trustAssignments
A list of trust assignments of form [{ src, dst, weight}, ..]
. src
and dst
are strings, while weight
is a float defined in the range 0.0
- 1.0
.initialEnergy
The amount of energy the Appleseed distributes across the trust graph's discovered nodes. Ziegler & Lausen's recommended default is 200
.spreadingCoefficient
Determines the amount of energy each node passes on to nodes it trusts (and correspondingly the amount of energy it gets to keep it self. Defined in the range 0.0
to 1.0
. Recommended default is 0.85
threshold
Iteration has stopped, and convergence is reached, when threshold
exceeds the largest change in energy in the past iteration.appleseed-metric
is available for dual-licensing. All the code in this repository is licensed as AGPL3.0-or-later
. If AGPL3 does not work for you, or your organization, contact cblgh-at-cblgh dotte org
to purchase a more permissive usage license.
If your project is a not-for-profit project, the permissive license will likely be available at very low-cost :)
FAQs
local trust metric algorithm
We found that appleseed-metric demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.
Research
Security News
Socket researchers have discovered multiple malicious npm packages targeting Solana private keys, abusing Gmail to exfiltrate the data and drain Solana wallets.