2 ms·

> Extensive name squatting, to the point that virtual no library uses the obvious name, because someone else got to it first. Maybe the obvious names should ha

by rat87 3y ago

> Extensive name squatting, to the point that virtual no library uses the obvious name, because someone else got to it first. Maybe the obvious names should have been pre banned. But I don't see the issue with non-obvious names either way you're going to have to get community recommendation/popularity to determine if brandonq/xml is better or worse then parsers/xml

jiggawatts 3y ago
In ASP.NET land, I regularly work on projects where there is an informal rule that only Microsoft-published packages can be used, unless there's good reason. You don't want to be using Ivan Vladimir's OAUTH package to sign in to Microsoft Entra ID. That probably has an FSB backdoor ready to activate. Why use that, when there's an equivalent Microsoft package? When any random Chinese, Russian, or Israeli national can publish "microsoftauth", you just know that some idiot will use it. That idiot may be me. Or a coworker. Or a transitive dependency. Or a transitive dependency introduced after a critical update to the immediate dependency. Or an external EXE tool deployed as a part of a third-party ISV binary product. Or... Make the only path lead to the pit of success, because the alternative is to let people wander around and fall into the pit of failure.
- Fluorescence 3y ago
  fwiw but when I saw a 3rd party library pretty much exactly like "microsoftauth" on nuget, I reported it and it was swiftly removed. I think we need to encourage a culture that package managers are our shared garden and we must all help in the weeding.
- carols10cents 3y ago
  Crates.io has publisher information-- namespacing is not required for that. For example, here are all the crates owned by the `azure` GitHub organization and published by the `azure-sdk-publish-rust` team: https://crates.io/teams/github:azure:azure-sdk-publish-rust https://crates.io/teams/github:azure:azure-sdk-publish-rust

by rat87 3y ago

jiggawatts 3y ago

In ASP.NET land, I regularly work on projects where there is an informal rule that only Microsoft-published packages can be used, unless there's good reason. You don't want to be using Ivan Vladimir's OAUTH package to sign in to Microsoft Entra ID. That probably has an FSB backdoor ready to activate. Why use that, when there's an equivalent Microsoft package? When any random Chinese, Russian, or Israeli national can publish "microsoftauth", you just know that some idiot will use it. That idiot may be me. Or a coworker. Or a transitive dependency. Or a transitive dependency introduced after a critical update to the immediate dependency. Or an external EXE tool deployed as a part of a third-party ISV binary product. Or... Make the only path lead to the pit of success, because the alternative is to let people wander around and fall into the pit of failure.

Fluorescence 3y ago
fwiw but when I saw a 3rd party library pretty much exactly like "microsoftauth" on nuget, I reported it and it was swiftly removed. I think we need to encourage a culture that package managers are our shared garden and we must all help in the weeding.
carols10cents 3y ago
Crates.io has publisher information-- namespacing is not required for that. For example, here are all the crates owned by the `azure` GitHub organization and published by the `azure-sdk-publish-rust` team: https://crates.io/teams/github:azure:azure-sdk-publish-rust https://crates.io/teams/github:azure:azure-sdk-publish-rust