[jfk13]

Huh - the same author also has https://crates.io/crates/memap and memap2, which explicitly say that they're "squatting to prevent a malicious typo package".

Not sure how to feel about this... on an individual-package level, it seems a sensible enough idea, but if it becomes a widespread practice, the namespace could get really cluttered.

[sedatk]

I guess "owner/packagename" convention could solve such issues as it's common with other package ecosystems.

[burntsushi]

Right. So then you add burnsushi/ripgrep instead. See the problem?

Namespaces are a solution or mitigation to some problem, but that problem is not malicious typo-squatting.

[Macha]

To me the problem solved by namespaces is making it clear what's an official package of a project and what's a non-malicious third party package intended to work with that project.

e.g. bevy and amethyst have claimed a load of crate names like bevy-x or amethyst_y because they thought they might release an official addon to their framework to handle those areas. e.g. bevy did it with this https://github.com/bevyengine/bevy-crate-reservations/blob/m... and amethyst did it the long way as far as I know

Organisations wanting to have consistent package names and users wanting to identify related packages are smaller problems than the "all the good names are taken" and "packages can impersonate other packages with typos" problems.

[burntsushi]

I'm not sure I necessarily agree with that... But yeah I specifically did not want to get into what namespaces do solve, and so was instead vague and just acknowledged that they're good for something. :-)

I will also say this: at the level of personal preference, and given my understanding of many other package ecosystems, I would have preferred namespaces from the start. But I don't feel very strongly one way or the other to be honest.

There is a related RFC open: https://github.com/rust-lang/rfcs/pull/3243

> "packages can impersonate other packages with typos" problems

I was pointing out that this is specifically not solved at all by namespacing. A package's name includes its namespace, and the namespace can be typo-squatted. (EDIT: Or wait, maybe I'm misunderstanding what you're saying. Perhaps I'm confused by what "these" refers to in your last sentence.)

[Macha]

I edited to clarify.

[stonemetal12]

>See the problem?

The only problem I see is that I don't know who owns ripgrep, so sticking some random name in front of it only adds to my confusion.

[burntsushi]

Yes. And the "random name" can be typo-squatted too. Compare burnsushi and burntsushi. I myself make that typo on occasion. :)

[lillecarl]

Popular crates could be "symlinked" into a global verified namespace, problem solved? I can't see any downsides other than some extra administration perhaps.

[burntsushi]

Yes, you buried all of the very difficult parts of your suggestion in "extra administration." Who decides what's popular? Who decides when it isn't popular any more? Who decides who gets which name in the global namespace?

I think I'm just going to refrain from talking about namespaces now. I tried to be super vague and just point out one thing that wasn't solved by namespaces (typo-squatting), but I've somehow gotten sucked into this discussion.

No more. I'm done. Sorry, it isn't directed at you. Just tired of the discussion around namespaces and the neglect to account for the "admin" parts of it.

[return_to_monke]

yup! And what if i reserve ripgrep/ripgrep as a typosquat, while the real one is burntsushi/ripgrep?

[sedatk]

For malicious intents, yes. But, for legitimate reasons where you need to have an "rg" package with a completely different use case, owner namespaced packages might provide a uniform solution.

[burntsushi]

Again, I was only commenting on typo-squatting. Namespaces do absolutely nothing to mitigate the typo-squatting problem.

[sedatk]

Got it. You're right.

[Macha]

Just moves the problem to packagename/packagename looking like a more "official" source.

[KMnO4]

> but if it becomes a widespread practice, the namespace could get really cluttered.

Crates.io is incredibly cluttered with namesquatting. It’s probably the worst package registry for it, even surpassing NPM.

Part of the problem is that they explicitly say name squatting isn’t against the rules.