Similar in the Python world: https://pypi.org/project/sklearn/
This one just depends on the correct `scikit-learn` package though.
“You meant to install ripgrep”
11–20 of 165 posts
Re: “You meant to install ripgrep”
#12What does one do if they wish to see the actual contents of this crate? The web interface I'm looking at contains no hints at peeking inside, not even direct archive download links, nothing.
I can't believe that a good way to see what's inside is to make a rust project, add the crate and then go searching around the local filesystem.
Re: “You meant to install ripgrep”
#13Hah! TIL. I had no idea someone did this. But it's smart. I should have thought of it! (I'm the author of ripgrep.)
You should not have done this unless you want to further normalize the practice of namespace squatting. This is the same type of behavior leads to domain squatting. While arguably being slightly more benign in the sense of hedging against typosquatting, if everyone started going things like that, we'd quickly begin to run into namespace exhaustion problems as people started ballooning their package namespace footprin…
I've worked on various package management ecosystems for close to a decade now, and I wouldn't qualify this (if 'burntsushi had done it) as namespace squatting. It's clearly not an attempt to reserve a name for unspecified future use (or as a potential typosquatting target); it's the name of the binary installed by the crate and an obvious mistake for an installing user to make.
Even flat namespaces are virtually infinite; a couple of extra names that correct user error do not pose a serious exhaustion risk.
Re: “You meant to install ripgrep”
#14This classic version of this in the Ruby ecosystem is "bundle"[1], which helpfully installs `bundler` for you. Of the 6.7 million downloads it has, I'm probably in there a dozen or so times.
Re: “You meant to install ripgrep”
#15I maintain a Python package that parks names like this. There's a Python library called pypi-parker[0] that makes it really easy to do this via CI.
Re: “You meant to install ripgrep”
#16Hah! TIL. I had no idea someone did this. But it's smart. I should have thought of it! (I'm the author of ripgrep.)
You should not have done this unless you want to further normalize the practice of namespace squatting. This is the same type of behavior leads to domain squatting. While arguably being slightly more benign in the sense of hedging against typosquatting, if everyone started going things like that, we'd quickly begin to run into namespace exhaustion problems as people started ballooning their package namespace footprin…
I think this is akin to saying nytimes.com buying nyt.com and redirecting it to nytimes.com is domain squatting.
Re: “You meant to install ripgrep”
#17What does one do if they wish to see the actual contents of this crate? The web interface I'm looking at contains no hints at peeking inside, not even direct archive download links, nothing. I can't believe that a good way to see what's inside is to make a rust project, add the crate and then go searching around the local filesystem.
The source is hosted alongside the documentation at https://docs.rs. But far simpler than that is just going to the prominent GitHub link.
Re: “You meant to install ripgrep”
#18What does one do if they wish to see the actual contents of this crate? The web interface I'm looking at contains no hints at peeking inside, not even direct archive download links, nothing. I can't believe that a good way to see what's inside is to make a rust project, add the crate and then go searching around the local filesystem.
crates.io is a little bare-bones sometimes.
I usually use lib.rs instead: https://lib.rs/crates/rg
That has a link to source: https://docs.rs/crate/rg/0.1.0/source/
And here's the Rust code: https://docs.rs/crate/rg/0.1.0/source/src/main.rs
Re: “You meant to install ripgrep”
#19Hah! TIL. I had no idea someone did this. But it's smart. I should have thought of it! (I'm the author of ripgrep.)
You should not have done this unless you want to further normalize the practice of namespace squatting. This is the same type of behavior leads to domain squatting. While arguably being slightly more benign in the sense of hedging against typosquatting, if everyone started going things like that, we'd quickly begin to run into namespace exhaustion problems as people started ballooning their package namespace footprin…
> Before you do something like that, always ask yourself: "What if everyone else started doing this?"
Seems fine to me. Something like one tenth of packages reserving a second name? Not a big deal.
Re: “You meant to install ripgrep”
#20I maintain a Python package that parks names like this. There's a Python library called pypi-parker[0] that makes it really easy to do this via CI. [0]: https://pypi.org/project/pypi-parker/
For what it's worth: using a tool like pypi-parker technically violates PEP 541[1], since it uploads projects with no functionality solely to reserve parts of the namespace. You may or may not get away with using it, depending on how you use it, but PyPI's admins (who I do not speak for) would be within their enumerated rights to ban any account that uses it to squat names.