4 ms·

Someone has created a Rust crate called libra, which claims to be a "Simple fantasty Adventure MUD" (sic). It's currently just a "Hello, world!" program. What

Someone has created a Rust crate called libra, which claims to be a "Simple fantasty Adventure MUD" (sic). It's currently just a "Hello, world!" program. What are the chances it's a placeholder for malicious/trojan code intended to steal Libra coins? (c.f. the event-stream backdoor[2]) [1] https://crates.io/crates/libra https://crates.io/crates/libra [2] https://news.ycombinator.com/item?id=18534392 https://news.ycombinator.com/item?id=18534392

apta 7y ago
Can't Facebook call it something like FB.Libra?
- steveklabnik 7y ago
  A dot is not allowed, but they could use a dash or underscore.
hombre_fatal 7y ago
Global unqualified namespace is a classic mistake. Causes all sorts of silly "squatting" and drama issues. Should really be: https://crates.io/crates/someorg/libra https://crates.io/crates/facebook/libra People like unqualified names because it's slightly cute, though.
- Waterluvian 7y ago
  I have been enjoying how npm is addressing this with @organization/project. Makes using npm a little less awful these days.
- jopsen 7y ago
  The argument I saw was that a global namespace ensured: A) Packages can change owners without changing names (and breaking downstreamers) B) It encourages creative names, rather can calling something myusername/http, you have to give the package a real name like hyper, express, curl, etc.
  - staticassertion 7y ago
    > B) It encourages creative names Who wants this?
    - steveklabnik 7y ago
      Empirically, libraries with unique names are more popular than ones that aren’t. It helps to have a unique name when searching, they’re more memorable, it’s easier to disambiguate between two libraries that do similar things, etc.
      - staticassertion 7y ago
        > Empirically, libraries with unique names are more popular than ones that aren’t. Seems like this is survivorship bias. All of the common names get squatted by people who never push code, and then anyone who's actually going to build something will need to pick something unique. Reqwest is more popular than request, for example. It's not exactly what most would expect, and if you search "request" you get the much less popular crate.
        steveklabnik 7y ago
        This is true even in ecosystems that have namespacing. And in hybrid systems, like npm’s, the non-namespaces versions are almost universally more popular than the namespaced ones.
        staticassertion 7y ago
        Interesting, but I wonder how this works in purely namespaced systems - if non standard names are more popular in, say, maven. I don't know. I'm unconvinced that this is a meaningful metric, and I worry more about typosquatting/ malicious dependencies, which, to my knowledge, crates.io does almost nothing to proactively deal with.
        7y ago
davemp 7y ago
Looks like the repo and github account were made today. [1] That’s pretty fishy to me. Crates.io has all sorts of other problems where it assumes good faith. [1]: https://github.com/kollaborator https://github.com/kollaborator

apta 7y ago

Can't Facebook call it something like FB.Libra?

steveklabnik 7y ago
A dot is not allowed, but they could use a dash or underscore.

hombre_fatal 7y ago

Global unqualified namespace is a classic mistake. Causes all sorts of silly "squatting" and drama issues. Should really be: https://crates.io/crates/someorg/libra https://crates.io/crates/facebook/libra People like unqualified names because it's slightly cute, though.

Waterluvian 7y ago
I have been enjoying how npm is addressing this with @organization/project. Makes using npm a little less awful these days.
jopsen 7y ago
The argument I saw was that a global namespace ensured: A) Packages can change owners without changing names (and breaking downstreamers) B) It encourages creative names, rather can calling something myusername/http, you have to give the package a real name like hyper, express, curl, etc.
- staticassertion 7y ago
  > B) It encourages creative names Who wants this?
  - steveklabnik 7y ago
    Empirically, libraries with unique names are more popular than ones that aren’t. It helps to have a unique name when searching, they’re more memorable, it’s easier to disambiguate between two libraries that do similar things, etc.
    - staticassertion 7y ago
      > Empirically, libraries with unique names are more popular than ones that aren’t. Seems like this is survivorship bias. All of the common names get squatted by people who never push code, and then anyone who's actually going to build something will need to pick something unique. Reqwest is more popular than request, for example. It's not exactly what most would expect, and if you search "request" you get the much less popular crate.
      - steveklabnik 7y ago
        This is true even in ecosystems that have namespacing. And in hybrid systems, like npm’s, the non-namespaces versions are almost universally more popular than the namespaced ones.
        staticassertion 7y ago
        Interesting, but I wonder how this works in purely namespaced systems - if non standard names are more popular in, say, maven. I don't know. I'm unconvinced that this is a meaningful metric, and I worry more about typosquatting/ malicious dependencies, which, to my knowledge, crates.io does almost nothing to proactively deal with.
        7y ago

davemp 7y ago

Looks like the repo and github account were made today. [1] That’s pretty fishy to me. Crates.io has all sorts of other problems where it assumes good faith. [1]: https://github.com/kollaborator https://github.com/kollaborator