5 ms·
Banks have a similar problem when people write cheques or set up standing orders. You have to put a name and the account number. I wonder if you could do somet
by blowski 10y ago
Banks have a similar problem when people write cheques or set up standing orders. You have to put a name and the account number.
I wonder if you could do something similar here - enter the name of the package and a code of some sort. I haven't thought this through in a lot of detail.
- PeterisP 10y agoBanks generally solve the issue with simple classic checksumming methods that guarantee that any number with a typo or swapped neighbouring characters will always result in an invalid number. That doesn't work with arbitrary names because they are, well, arbitrary.
- throwawaysocks 10y agoWhy not? Central repositories could require that all names are within a certain Levenshtein distance of one another. This could get mildly annoying every once in a while when there are legitimate non-clashing names. A better metric/typo recognition technique is probably possible. Or else some manual process for requesting exceptions (maybe with a tiny fee to help fund the overall project) would also address this problem. EDIT: Just downloaded and read the thesis abstract. The author actually suggests the first idea: "The analytical part generates ideas for countermeasures that allow repository maintainers or users to detect typosquatting attacks in the future. For this purpose potential typosquatting candidates could be generated for each legitimate package name with the help of the Levenshtein distance algorithms or Bayesian networks. Another option that can be considered is the Metaphone algorithm."
- pc86 10y ago"Sorry, the otherwise 100% valid and reasonable name you've selected for your project is invalid because an algorithm has determined it is arbitrarily too close to this other unrelated project. Try again." Who would use that?
- nneonneo 10y ago"The project title has been flagged due to similarity with an existing name. Your submission has been sent for moderator review". Package managers have humans to deal with edge cases (removing malicious packages, investigating package errors, etc.) and this is no different. It wouldn't significantly increase their burden because only a small fraction of package names should require human validation.
- Klathmon 10y agoOr just refer to packages by 2 names. Maintainer/PackageName It solves so many problems, this included.
- blowski 10y agoI guess that would work, as long as you require PackageName to be unique across all Maintainers.
- deleted 10y ago[deleted]
- kibwen 10y agoThough this would obviate the most compelling argument for namespacing, which is to allow exactly that.
- jessaustin 10y agoOne imagines that "Maintainer" could be typoed as e.g. "Maintaner" just as easily as "PackageName" could be "PackagName".
- Klathmon 10y agoBut then the attacker would need to register a ton of packages that match other popular packages under their namespace which can set off some alarms. (I guess "solve" was a bit too strong of a word to use there...) There could also be some other cool tricks you could apply (This is the first time you are installing a package from "Maintaner", would you like to continue?)
- jessaustin 10y agoAn attacker would only need to register the equivalent of the package under attack. Other packages would continue to error out harmlessly as they did before. The maintainer-level confirmation could be of slight assistance to advanced users, but it's no panacea.