61–70 of 148 posts
This only seems to be an issue for languages where packages reside in a global namespace, like Python, Rust etc. I think most languages these days are a bit smarter and avoid this beginner mistake (for various reasons).
I'm a fan of the approach of personally submitting projects to the repository maintainer (e.g. through GitHub issues), and having the maintainer personally approve them. It does raise the barrier to entry, but it would prevent typosquatting and regular namesquatting. EDIT: Does any major package manager provide a "did you mean" functionality, offering a list of actual package names similar to what you typed?
That's a massive burden on the poor person who has to ok the package - especially at NPM's scale, for example.
Reminds me of the quote, 'there are only two hard things in computer science: naming things, cache invalidation and off-by-one errors.' I think that this clearly falls under the heading 'naming issue.' People know what they want, but do not enter it properly. I can't think of a 100% off-hand, which isn't surprising, because it's a hard problem. pmontra's suggestion to use typo blacklisting ain't a bad idea. Maybe som…
Banks have a similar problem when people write cheques or set up standing orders. You have to put a name and the account number. I wonder if you could do something similar here - enter the name of the package and a code of some sort. I haven't thought this through in a lot of detail.
Maintainer/PackageName
This seems like pretty unethical research to me. Also, doesn't point out that the bigger threat is that this is wormable.
There was no actual intrusion, so this feels like fair game to me. Especially since mitigating a very possible attack vector is a direct result of running experiment. Still, hopefully the researchers got an IRB to sign off on the experiment setup...
This only seems to be an issue for languages where packages reside in a global namespace, like Python, Rust etc. I think most languages these days are a bit smarter and avoid this beginner mistake (for various reasons).
The only way this is 'solved' is if some third party authority hands out top level names and refuses to register names that are similar to other names for some definition of similar. The number of levels between top level and package name is irrelevant.
This only seems to be an issue for languages where packages reside in a global namespace, like Python, Rust etc. I think most languages these days are a bit smarter and avoid this beginner mistake (for various reasons).
couldn't you register a typo namespace?
That's something that can be flagged for manual review before it gets too far.
Earlier quoted context omitted.
Banks have a similar problem when people write cheques or set up standing orders. You have to put a name and the account number. I wonder if you could do something similar here - enter the name of the package and a code of some sort. I haven't thought this through in a lot of detail.
Or just refer to packages by 2 names. Maintainer/PackageName It solves so many problems, this included.
Earlier quoted context omitted.
Surely some troll would deploy a fleet of machines that flood package indexes with requests to available names, effectively blacklisting entire dictionaries and eventually all short names.
Yeah, this is what I came to think too. I mentioned it in another comment. Somebody suggested to use a distance indicator, but trolls could attack that too.
Earlier quoted context omitted.
Banks have a similar problem when people write cheques or set up standing orders. You have to put a name and the account number. I wonder if you could do something similar here - enter the name of the package and a code of some sort. I haven't thought this through in a lot of detail.
Or just refer to packages by 2 names. Maintainer/PackageName It solves so many problems, this included.