3 ms·
Where did the request for namespaces on crates.io go? At the moment I have to investigate every crate someone recommends and its dependencies to avoid a possibl
by janice1999 2y ago
Where did the request for namespaces on crates.io go? At the moment I have to investigate every crate someone recommends and its dependencies to avoid a possible future XZ situation (checking the GitHub, committers and if they have Linkedin profiles at legitimate companies). Having "mozilla/foo" or "rust-foundation/bar" would be a huge improvement.
- lifthrasiir 2y agoNamespace is merely a workaround, not a solution. Arbitrary namespace prefix is still open for registration so it can be squatted just like package name. One essential part of the real solution would be sandboxing of build scripts.
- bfrog 2y agoNot if it requires dns verification… which would be great.
- lifthrasiir 2y agoDomain squatting was a thing long before package name squatting.
- bfrog 2y agoyes but its hard to argue that if you've verified that you own say... somecompany.com that you shouldn't have control over the crates.io org for the same name.