5 ms·

Huh - the same author also has https://crates.io/crates/memap https://crates.io/crates/memap and memap2, which explicitly say that they're "squatting to prevent

by jfk13 4y ago

Huh - the same author also has https://crates.io/crates/memap https://crates.io/crates/memap and memap2, which explicitly say that they're "squatting to prevent a malicious typo package". Not sure how to feel about this... on an individual-package level, it seems a sensible enough idea, but if it becomes a widespread practice, the namespace could get really cluttered.

KMnO4 4y ago
> but if it becomes a widespread practice, the namespace could get really cluttered. Crates.io is incredibly cluttered with namesquatting. It’s probably the worst package registry for it, even surpassing NPM. Part of the problem is that they explicitly say name squatting isn’t against the rules.
sedatk 4y ago
I guess "owner/packagename" convention could solve such issues as it's common with other package ecosystems.
- Macha 4y ago
  Just moves the problem to packagename/packagename looking like a more "official" source.
- burntsushi 4y ago
  Right. So then you add burnsushi/ripgrep instead. See the problem? Namespaces are a solution or mitigation to some problem, but that problem is not malicious typo-squatting.
  - sedatk 4y ago
    For malicious intents, yes. But, for legitimate reasons where you need to have an "rg" package with a completely different use case, owner namespaced packages might provide a uniform solution.
    - burntsushi 4y ago
      Again, I was only commenting on typo-squatting. Namespaces do absolutely nothing to mitigate the typo-squatting problem.
      - sedatk 4y ago
        Got it. You're right.
  - Macha 4y ago
    To me the problem solved by namespaces is making it clear what's an official package of a project and what's a non-malicious third party package intended to work with that project. e.g. bevy and amethyst have claimed a load of crate names like bevy-x or amethyst_y because they thought they might release an official addon to their framework to handle those areas. e.g. bevy did it with this https://github.com/bevyengine/bevy-crate-reservations/blob/main/reserved_crates https://github.com/bevyengine/bevy-crate-reservations/blob/m... and amethyst did it the long way as far as I know Organisations wanting to have consistent package names and users wanting to identify related packages are smaller problems than the "all the good names are taken" and "packages can impersonate other packages with typos" problems.
    - burntsushi 4y ago
      I'm not sure I necessarily agree with that... But yeah I specifically did not want to get into what namespaces do solve, and so was instead vague and just acknowledged that they're good for something. :-) I will also say this: at the level of personal preference, and given my understanding of many other package ecosystems, I would have preferred namespaces from the start. But I don't feel very strongly one way or the other to be honest. There is a related RFC open: https://github.com/rust-lang/rfcs/pull/3243 https://github.com/rust-lang/rfcs/pull/3243 > "packages can impersonate other packages with typos" problems I was pointing out that this is specifically not solved at all by namespacing. A package's name includes its namespace, and the namespace can be typo-squatted. (EDIT: Or wait, maybe I'm misunderstanding what you're saying. Perhaps I'm confused by what "these" refers to in your last sentence.)
      - Macha 4y ago
        I edited to clarify.
  - stonemetal12 4y ago
    >See the problem? The only problem I see is that I don't know who owns ripgrep, so sticking some random name in front of it only adds to my confusion.
    - burntsushi 4y ago
      Yes. And the "random name" can be typo-squatted too. Compare burnsushi and burntsushi. I myself make that typo on occasion. :)
      - lillecarl 4y ago
        Popular crates could be "symlinked" into a global verified namespace, problem solved? I can't see any downsides other than some extra administration perhaps.
        burntsushi 4y ago
        Yes, you buried all of the very difficult parts of your suggestion in "extra administration." Who decides what's popular? Who decides when it isn't popular any more? Who decides who gets which name in the global namespace? I think I'm just going to refrain from talking about namespaces now. I tried to be super vague and just point out one thing that wasn't solved by namespaces (typo-squatting), but I've somehow gotten sucked into this discussion. No more. I'm done. Sorry, it isn't directed at you. Just tired of the discussion around namespaces and the neglect to account for the "admin" parts of it.
    - return_to_monke 4y ago
      yup! And what if i reserve ripgrep/ripgrep as a typosquat, while the real one is burntsushi/ripgrep?
deleted 4y ago
[deleted]

by jfk13 4y ago

KMnO4 4y ago

> but if it becomes a widespread practice, the namespace could get really cluttered. Crates.io is incredibly cluttered with namesquatting. It’s probably the worst package registry for it, even surpassing NPM. Part of the problem is that they explicitly say name squatting isn’t against the rules.

sedatk 4y ago

I guess "owner/packagename" convention could solve such issues as it's common with other package ecosystems.

Macha 4y ago
Just moves the problem to packagename/packagename looking like a more "official" source.
burntsushi 4y ago
Right. So then you add burnsushi/ripgrep instead. See the problem? Namespaces are a solution or mitigation to some problem, but that problem is not malicious typo-squatting.
- sedatk 4y ago
  For malicious intents, yes. But, for legitimate reasons where you need to have an "rg" package with a completely different use case, owner namespaced packages might provide a uniform solution.
  - burntsushi 4y ago
    Again, I was only commenting on typo-squatting. Namespaces do absolutely nothing to mitigate the typo-squatting problem.
    - sedatk 4y ago
      Got it. You're right.
- Macha 4y ago
  To me the problem solved by namespaces is making it clear what's an official package of a project and what's a non-malicious third party package intended to work with that project. e.g. bevy and amethyst have claimed a load of crate names like bevy-x or amethyst_y because they thought they might release an official addon to their framework to handle those areas. e.g. bevy did it with this https://github.com/bevyengine/bevy-crate-reservations/blob/main/reserved_crates https://github.com/bevyengine/bevy-crate-reservations/blob/m... and amethyst did it the long way as far as I know Organisations wanting to have consistent package names and users wanting to identify related packages are smaller problems than the "all the good names are taken" and "packages can impersonate other packages with typos" problems.
  - burntsushi 4y ago
    I'm not sure I necessarily agree with that... But yeah I specifically did not want to get into what namespaces do solve, and so was instead vague and just acknowledged that they're good for something. :-) I will also say this: at the level of personal preference, and given my understanding of many other package ecosystems, I would have preferred namespaces from the start. But I don't feel very strongly one way or the other to be honest. There is a related RFC open: https://github.com/rust-lang/rfcs/pull/3243 https://github.com/rust-lang/rfcs/pull/3243 > "packages can impersonate other packages with typos" problems I was pointing out that this is specifically not solved at all by namespacing. A package's name includes its namespace, and the namespace can be typo-squatted. (EDIT: Or wait, maybe I'm misunderstanding what you're saying. Perhaps I'm confused by what "these" refers to in your last sentence.)
    - Macha 4y ago
      I edited to clarify.
- stonemetal12 4y ago
  >See the problem? The only problem I see is that I don't know who owns ripgrep, so sticking some random name in front of it only adds to my confusion.
  - burntsushi 4y ago
    Yes. And the "random name" can be typo-squatted too. Compare burnsushi and burntsushi. I myself make that typo on occasion. :)
    - lillecarl 4y ago
      Popular crates could be "symlinked" into a global verified namespace, problem solved? I can't see any downsides other than some extra administration perhaps.
      - burntsushi 4y ago
        Yes, you buried all of the very difficult parts of your suggestion in "extra administration." Who decides what's popular? Who decides when it isn't popular any more? Who decides who gets which name in the global namespace? I think I'm just going to refrain from talking about namespaces now. I tried to be super vague and just point out one thing that wasn't solved by namespaces (typo-squatting), but I've somehow gotten sucked into this discussion. No more. I'm done. Sorry, it isn't directed at you. Just tired of the discussion around namespaces and the neglect to account for the "admin" parts of it.
  - return_to_monke 4y ago
    yup! And what if i reserve ripgrep/ripgrep as a typosquat, while the real one is burntsushi/ripgrep?

deleted 4y ago

[deleted]