3 ms·

If anything, namespacing doesn't go far enough. We have a wonderful namespacing mechanism already for the Internet - it's called DNS. We use DNS validation as a

If anything, namespacing doesn't go far enough. We have a wonderful namespacing mechanism already for the Internet - it's called DNS. We use DNS validation as a security foundation for issuing TLS certificates. Package registries should allow me to "own a domain" - backed up by DNS validation - and upload packages under that name. "Domain ownership" should be paired to a timestamp issued at verification time, so that a) package uploading can be blocked entirely if the DNS verification is lost, b) consumers can continue to download packages under the old domain timestamp c) domain ownership can still transfer as needed d) changes in ownership are tracked, and consumers are notified. Why does everybody always have to reinvent the wheel? DNS has been around for decades. Using DNS records to verify ownership has been around since, what, the early days of the ACME protocol in 2014/2015? Earlier?

steveklabnik 6y ago
DNS records have a financial and technical barrier to account and package creation that we found unacceptable; and those costs are ongoing, leading to an unacceptable level of mutability.
- solatic 6y ago
  Well, you don't have to only accept DNS records! It's like arguing that independent email providers shouldn't provide general addresses like @gmail.com or @fastmail.com if they're going to provide any support for custom domains. You could do both. In fact, offering support for custom domains is usually an opportunity to up-sell, particularly to the kind of customers who have already shown that they're willing to spend money on an on-going basis (by paying for the DNS name).
  - steveklabnik 6y ago
    I’m still not sure how that solves the problem, but regardless, the point is that there are many possibilities and tons of complexity. It is not a simple, unambiguous problem with a clear correct answer.
    - solatic 6y ago
      The problem is caused over people squatting on desirable package names, right? Only solves the issue up to the point where people start to squat on desirable namespaces. If you only develop one or two packages, you don't really care about the squatting issue. Especially if a non-DNS-namespace is free. Light users are generally unaffected by the problem, so they continue to fit within a "free" offering. Squatting is a non-issue with DNS. Nobody can take your domain from you; effectively, using DNS outsources the control issue to DNS control. The only issue is to guarantee consumers that their builds won't break just because their packages went through forced deprecation when DNS control transferred. The people who suffer from the issue badly enough to need DNS namespacing are either heavy users (who are therefore much more likely to pay) or corporate entities that actually desire a paid option.
      - steveklabnik 6y ago
        For what it's worth, and I don't have a ton of numbers here, the loudest people who want namespaces are people who haven't published a lot of packages, in my estimation. I don't have numbers on that, just gut feels. > Squatting is a non-issue with DNS. We must be living on a different web :)

steveklabnik 6y ago

DNS records have a financial and technical barrier to account and package creation that we found unacceptable; and those costs are ongoing, leading to an unacceptable level of mutability.

solatic 6y ago
Well, you don't have to only accept DNS records! It's like arguing that independent email providers shouldn't provide general addresses like @gmail.com or @fastmail.com if they're going to provide any support for custom domains. You could do both. In fact, offering support for custom domains is usually an opportunity to up-sell, particularly to the kind of customers who have already shown that they're willing to spend money on an on-going basis (by paying for the DNS name).
- steveklabnik 6y ago
  I’m still not sure how that solves the problem, but regardless, the point is that there are many possibilities and tons of complexity. It is not a simple, unambiguous problem with a clear correct answer.
  - solatic 6y ago
    The problem is caused over people squatting on desirable package names, right? Only solves the issue up to the point where people start to squat on desirable namespaces. If you only develop one or two packages, you don't really care about the squatting issue. Especially if a non-DNS-namespace is free. Light users are generally unaffected by the problem, so they continue to fit within a "free" offering. Squatting is a non-issue with DNS. Nobody can take your domain from you; effectively, using DNS outsources the control issue to DNS control. The only issue is to guarantee consumers that their builds won't break just because their packages went through forced deprecation when DNS control transferred. The people who suffer from the issue badly enough to need DNS namespacing are either heavy users (who are therefore much more likely to pay) or corporate entities that actually desire a paid option.
    - steveklabnik 6y ago
      For what it's worth, and I don't have a ton of numbers here, the loudest people who want namespaces are people who haven't published a lot of packages, in my estimation. I don't have numbers on that, just gut feels. > Squatting is a non-issue with DNS. We must be living on a different web :)