4 ms·
I can understand not liking it, but I don't understand why you find it strange: global namespaces are the norm in language package distribution. RubyGems, NPM,
by woodruffw 4y ago
I can understand not liking it, but I don't understand why you find it strange: global namespaces are the norm in language package distribution. RubyGems, NPM, PyPI, and Crates all use flat namespaces (either by default or as their only supported mode).
Namespace partitioning has advantages, but it also doesn't solve squatting problems on its own: anybody (or any process) that's fooled by `requests` vs `pyrequests` is also going to be fooled by `some-owner/requests` vs. `requests-org/requests` (the latter being the fake one).
- phone8675309 4y agoPerl got this right 20 years ago.
- nextaccountic 4y agohow does perl work in this regard?
- woodruffw 4y agoI actually agree, but that's not namespacing in the way that the GP meant: Perl has curated topical namespaces that multiple unrelated users share, rather than identity or organization-owned namespaces.
- duskwuff 4y agoI'm not convinced it did. In some ways it's worse -- Perl allows distributions to install modules inside another distribution's namespace.
- rogerbinns 4y agoI agree that namespacing doesn't solve all the problems, but I do think it significantly reduces the attack surface. It is sort of like a checksum for a package, combining the publisher name with the package name instead of having just bare package names.
- woodruffw 4y agoAgreed! The problem is that the publisher's name isn't always clear: a lot of open source maintainers (myself included) publish major packages under their own name; a less familiar user could easily be confused into choosing the "official looking" name instead. I think the most "complete" solution here needs to involve code signing.
- cgh 4y agoOne of the largest and oldest package repositories, Maven, got it right two decades ago. No one ever seems to mention it though.
- krapp 4y agoPHP got it right as well.
- deleted 4y ago[deleted]