Live data from Hacker News

“You meant to install ripgrep”

crates.io

101–110 of 165 posts

Re: “You meant to install ripgrep”

#103

Is it faster than Silver Searcher (ag)?

Yes. And less buggy.

If someone can find a meaningful case where ag is faster than ripgrep, then I'm happy to accept a bug report. I'll do my best at that point to give an analysis of the benchmark, and if it's correct, I'll either try to fix it or say why it's hard to fix.

By "meaningful" I mean "something that is noticeable to humans." So for example, reporting a bug because ripgrep took 9ms and ag took 7ms on a tiny repo is one I would consider not meaningful. :)

(Sorry about the verbose caveats, but just trying to head off responses I've got in the past.)

Re: “You meant to install ripgrep”

#105
post #102

Crates should be namespaced by user. This is a disaster waiting to happen.

Then you'd have people installing "burnedsushi/ripgrep" instead of "burntsushi/ripgrep". It only kicks the problem one step down without fixing it.

worse, if the correct one was `burntsushi/ripgrep`, someone else would just squat `ripgrep/ripgrep`.

Re: “You meant to install ripgrep”

#106
post #25

Huh - the same author also has https://crates.io/crates/memap and memap2, which explicitly say that they're "squatting to prevent a malicious typo package". Not sure how to feel about this... on an individual-package level, it seems a sensible enough idea, but if it becomes a widespread practice, the namespace could get really cluttered.

> but if it becomes a widespread practice, the namespace could get really cluttered.

Crates.io is incredibly cluttered with namesquatting. It’s probably the worst package registry for it, even surpassing NPM.

Part of the problem is that they explicitly say name squatting isn’t against the rules.

Re: “You meant to install ripgrep”

#107

Earlier quoted context omitted.

Would you consider taking the "rg" package and redirecting people to ripgrep? I mean, asking the current owner to kindly donate it to you.

Yes, I'd be fine with that. I just spent a few minutes looking for their contact info, but I can't find it. EDIT: Found their email via git. Always forget about that one.

There's a pun about finding to be had here.

Re: “You meant to install ripgrep”

#108
post #91

Earlier quoted context omitted.

Unrelated, but thank you for your work! You’ve saved me tens if not hundreds of hours with ripgrep, and I’ve become a huge evangelist of it at my workplace. When I’m helping someone understand how to debug customer issues, the first thing I tell them is to install ripgrep. Truly a fantastic piece of software.

w00t! Thanks for the kind words. :-)

"gron | rg", because life is too short to learn jq.

Amazing work on rg!

Re: “You meant to install ripgrep”

#109

Earlier quoted context omitted.

>See the problem? The only problem I see is that I don't know who owns ripgrep, so sticking some random name in front of it only adds to my confusion.

Yes. And the "random name" can be typo-squatted too. Compare burnsushi and burntsushi. I myself make that typo on occasion. :)

Popular crates could be "symlinked" into a global verified namespace, problem solved? I can't see any downsides other than some extra administration perhaps.

Re: “You meant to install ripgrep”

#110
post #32

Earlier quoted context omitted.

I guess "owner/packagename" convention could solve such issues as it's common with other package ecosystems.

Right. So then you add burnsushi/ripgrep instead. See the problem? Namespaces are a solution or mitigation to some problem, but that problem is not malicious typo-squatting.

For malicious intents, yes. But, for legitimate reasons where you need to have an "rg" package with a completely different use case, owner namespaced packages might provide a uniform solution.
Post reply on HN