3 ms·
Could you not do that on PyPi and rubygems as well?
by yazboo 8y ago
Could you not do that on PyPi and rubygems as well?
- doublerebel 8y agoAbsolutely not. PyPi and Rubygems have much more strict and sane ownership policies to prevent unauthorized takeovers of packages. (Same with apt and every other major package repo.) No package in any package manager, if it contains code, and greater than 0 downloads and dependencies, should ever be replaced. The cost of storing an old package is miniscule compared to a system where anyone can petition for a package name takeover and cause unlimited cost through the effects of takeover. 30 days is absurdly short in the lifetime of software and does nothing good for the community. Package squatting is not a real problem for anyone. In this case, the owner wanted the ownership change so it's really a non-event.
- krainboltgreene 8y ago> Rubygems have much more strict and sane ownership policies to prevent unauthorized takeovers of packages No we don't. Our process is just as secure as npm's. Please stop talking about things you don't actually know.