3 ms·

How do namespaces measurably increase security?

• richbell 3y ago
  They reduce the risk of supply chain attacks like typo squatting or Dependency confusion.
  • littlestymaar 3y ago
    Funnily enough, they in fact increase it.
  • carols10cents 3y ago
    Namespaces can't be typosquatted?
    • richbell 3y ago
      I don't believe I said that. The point is that it's much easier to make a mistake typing "requests" than " org.kennethreitz:requests" (as a pure hypothetical.) It also means that more than one project can have a module called "utils" or "common", which once again reduces the risk of people accidentally downloading the wrong thing.
      • littlestymaar 3y ago
        > The point is that it's much easier to make a mistake typing "requests" than " org.kennethreitz:requests" (as a pure hypothetical.) Sorry what? It's strictly the opposite: more character to type equals more risks to make a mistake. In fact, in the general case, namespace increase the risk of supply chain attacks, because it makes packages names even less discernable.