4 ms·
It does at least partially solve the problem of "typosquatting" where installing `anglar` could potentially be a malicious version. It makes it more obvious whe
by Klathmon 9y ago
It does at least partially solve the problem of "typosquatting" where installing `anglar` could potentially be a malicious version. It makes it more obvious when it's happening (oh, you setup the `anglar` and created a ton of typo'd packages with a few lines changed each? That's probably safe to ban...)
It also allows those orgs to group "sibling" or sub-packages under their main name. So I know that `@angular/cool-angular-plugin` is actually from angular.
- lhorie 9y agoI get the benefits of namespacing. I'm just not sure making it mandatory solves any issues. For example, what's stopping someone from publishing `@developit/greenlet` or `@greenlet/greenlet` without owning the respective org/username in github?
- Klathmon 9y agoNothing is stopping that. But for the downside of "having to type a little bit more", I think it's more than useful enough at what it does fix/solve. In other words, it solves between 0 and "a bunch" of problems for packages, and the downside is fixed at "needs to type a little more". Even in the worst case, it's not that much harm, but in the best case could prevent exploits.