3 ms·

The issue is "but people will just squat namespaces". I don't agree, fwiw, but that's one of the main push backs.

MrBuddyCasino 3y ago
This is easily solved by 1) using registered domains as namespace (if one exists) 2) proving that you have access to said domain This is how Maven does it and it works very well.
- brickteacup 3y ago
  which forces people to pay to register a domain just to publish packages...
  - Ygg2 3y ago
    I don't think that's necessary, since cargo and source repo is tightly linked, just make that source repo supports returning user name or org name. I don't see a reason you couldn't use exisiting org/username from Github as namespace, can they squat on it? Not unless they steal it, in which case, Github should be notified.
    - steveklabnik 3y ago
      What happens when crates are transferred? Everyone's build breaks.
      - Ygg2 3y ago
        What do you mean by transferred? Like you have Ygg2/stuff and want it to be replaced by Org/stuff? In that case just yank all versions on Ygg2/stuff, and the any change update from then on references Org/stuff.
        steveklabnik 3y ago
        Yes. For example, the semver package has lived in these places: * rust-lang/semver * steveklabnik/sevmer * dtolnay/semver That everyone didn't need to do "yank everything, change all cargo.tomls" is a huge advantage of not being tied to this.
        Ygg2 3y ago
        Well change all future `cargo.toml`s. If you want a more complex solution, then you would need a more complex index of ownership for cargo. E.g. alias or transfer ownership. It could be as simple as displaying "This crate is deprecated use org/crate instead". Or as complex as what crate is no longer valid. One needs to know what exactly are cargo namespace requirements? > Yes. For example, the semver package has lived in these places: Sure, and squatters squatted over many crate name extorting bribes to release them.
  - MrBuddyCasino 3y ago
    I think Github repos work too.
- insanitybit 3y ago
  That's not easily solved at all. That's an incredibly complex system you're proposing. IMO the solution is simpler. Heavily rate limit the creation of namespaces. That's less viable for crate names, but it should be very uncommon to create more than a few namespaces. You could give people a low number that aren't rate limited, like 5, and then rate limit them to 2 a day afterwards. They can then publish unlimited crates under those namespaces.

This is easily solved by 1) using registered domains as namespace (if one exists) 2) proving that you have access to said domain This is how Maven does it and it works very well.

brickteacup 3y ago
which forces people to pay to register a domain just to publish packages...
- Ygg2 3y ago
  I don't think that's necessary, since cargo and source repo is tightly linked, just make that source repo supports returning user name or org name. I don't see a reason you couldn't use exisiting org/username from Github as namespace, can they squat on it? Not unless they steal it, in which case, Github should be notified.
  - steveklabnik 3y ago
    What happens when crates are transferred? Everyone's build breaks.
    - Ygg2 3y ago
      What do you mean by transferred? Like you have Ygg2/stuff and want it to be replaced by Org/stuff? In that case just yank all versions on Ygg2/stuff, and the any change update from then on references Org/stuff.
      - steveklabnik 3y ago
        Yes. For example, the semver package has lived in these places: * rust-lang/semver * steveklabnik/sevmer * dtolnay/semver That everyone didn't need to do "yank everything, change all cargo.tomls" is a huge advantage of not being tied to this.
        Ygg2 3y ago
        Well change all future `cargo.toml`s. If you want a more complex solution, then you would need a more complex index of ownership for cargo. E.g. alias or transfer ownership. It could be as simple as displaying "This crate is deprecated use org/crate instead". Or as complex as what crate is no longer valid. One needs to know what exactly are cargo namespace requirements? > Yes. For example, the semver package has lived in these places: Sure, and squatters squatted over many crate name extorting bribes to release them.
- MrBuddyCasino 3y ago
  I think Github repos work too.
insanitybit 3y ago
That's not easily solved at all. That's an incredibly complex system you're proposing. IMO the solution is simpler. Heavily rate limit the creation of namespaces. That's less viable for crate names, but it should be very uncommon to create more than a few namespaces. You could give people a low number that aren't rate limited, like 5, and then rate limit them to 2 a day afterwards. They can then publish unlimited crates under those namespaces.