Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“You meant to install ripgrep”

crates.io

Post reply on HN
Print view View original

21–30 of 165 posts

Re: “You meant to install ripgrep”

#21

Post by 0xbadcafebee »

salawat wrote: post #10
burntsushi wrote: post #3

Hah! TIL. I had no idea someone did this. But it's smart. I should have thought of it! (I'm the author of ripgrep.)

You should not have done this unless you want to further normalize the practice of namespace squatting. This is the same type of behavior leads to domain squatting. While arguably being slightly more benign in the sense of hedging against typosquatting, if everyone started going things like that, we'd quickly begin to run into namespace exhaustion problems as people started ballooning their package namespace footprin…

I'm fully in support of exhausting namespaces in programming languages. It's really annoying that people keep making one-off projects with weird names that reinvent the wheel.

In CPAN, you create a module with a hierarchical name (Net::LDAP), and people inherit from it and extend the namespace to add new functionality (Net::LDAP::Batch). Finding a package that does what you want is [relatively] easy. Old code gets maintained rather than somebody reinventing it for the 72nd time with a hodge-podge of functionality.

Re: “You meant to install ripgrep”

#22

Post by maxbond »

pie_flavor wrote: post #17
noswi wrote: post #12

What does one do if they wish to see the actual contents of this crate? The web interface I'm looking at contains no hints at peeking inside, not even direct archive download links, nothing. I can't believe that a good way to see what's inside is to make a rust project, add the crate and then go searching around the local filesystem.

The source is hosted alongside the documentation at https://docs.rs . But far simpler than that is just going to the prominent GitHub link.

In this case, there isn't a GitHub link, as there's no repository in the Cargo.toml: https://docs.rs/crate/rg/0.1.0/source/Cargo.toml

Re: “You meant to install ripgrep”

#23

Post by orf »

taink wrote: post #8
dtolnay wrote: post #5

Earlier quoted context omitted.

Seems like it would be better to contain: compile_error!("You meant to …"); so that the install would fail and `cargo uninstall rg` wouldn't be needed.

Can always-failing-to-compile crates be deployed to the registry?

Yes

Re: “You meant to install ripgrep”

#24

Post by burntsushi »

salawat wrote: post #10
burntsushi wrote: post #3

Hah! TIL. I had no idea someone did this. But it's smart. I should have thought of it! (I'm the author of ripgrep.)

You should not have done this unless you want to further normalize the practice of namespace squatting. This is the same type of behavior leads to domain squatting. While arguably being slightly more benign in the sense of hedging against typosquatting, if everyone started going things like that, we'd quickly begin to run into namespace exhaustion problems as people started ballooning their package namespace footprin…

> Before you do something like that, always ask yourself: "What if everyone else started doing this?"

No, I don't think so. There is no universality implied in my comment or in the specific practice here. You can make value judgments based on specific circumstances. For example:

* How many people try 'cargo install rg' and have it do the wrong thing? I'd say "probably a lot."

* Is 'rg' on its own something that is a likely useful or desirable name on its own? No, I don't think so.

This doesn't have to mean that everyone should do it for every possible alias of every crate out there. You can say things like "yeah I think it makes sense to squat a name here to improve failure modes for folks."

Other than that, I have squatted a few names before. I don't see anything wrong with the practice in and of itself. It's when it gets abused that it starts to become a problem.

Re: “You meant to install ripgrep”

#25

Post by jfk13 »

Huh - the same author also has https://crates.io/crates/memap and memap2, which explicitly say that they're "squatting to prevent a malicious typo package".

Not sure how to feel about this... on an individual-package level, it seems a sensible enough idea, but if it becomes a widespread practice, the namespace could get really cluttered.

Re: “You meant to install ripgrep”

#26

Post by burntsushi »

dtolnay wrote: post #5
micouay wrote: post #2

`rg` has only one version, and one line of code: println!("You meant to install ripgrep: type `cargo uninstall rg` followed by `cargo install ripgrep`");

Seems like it would be better to contain: compile_error!("You meant to …"); so that the install would fail and `cargo uninstall rg` wouldn't be needed.

Yeah that sounds much nicer.

Re: “You meant to install ripgrep”

#29

Post by BossingAround »

burntsushi wrote: post #3

Hah! TIL. I had no idea someone did this. But it's smart. I should have thought of it! (I'm the author of ripgrep.)

Would you consider taking the "rg" package and redirecting people to ripgrep? I mean, asking the current owner to kindly donate it to you.

Re: “You meant to install ripgrep”

#30

Post by maxbond »

salawat wrote: post #10
burntsushi wrote: post #3

Hah! TIL. I had no idea someone did this. But it's smart. I should have thought of it! (I'm the author of ripgrep.)

You should not have done this unless you want to further normalize the practice of namespace squatting. This is the same type of behavior leads to domain squatting. While arguably being slightly more benign in the sense of hedging against typosquatting, if everyone started going things like that, we'd quickly begin to run into namespace exhaustion problems as people started ballooning their package namespace footprin…

I'd like to note there are three perverse incentives that lead to abuses of public namespaces (that I am aware of - please tell me if I've missed any):

1.) The use of names as a speculative financial instrument (in all shades of grey, up to and including extortion for lapsed or stolen names)

2.) The use of names as vectors of attack, such as by exploiting typos or homographs (such as malicious packages)

3.) The reserving of names you don't have a sincere or immediate intention to use (hoarding/FOMO)

This isn't very much like the situation with domains, which is primarily a result of #1 (there is no market for crates.io names, as far as I'm aware). #3 is a problem to some degree on crates.io, my understanding is that they basically treat this as a human moderation problem. #2 is endemic to all package managers.

By putting a helpful instead of malicious package here, the community (and Richard Dodd in particular) are able to mitigate the hazard of #2 (unless this account is compromised or turns malicious - a better but imperfect situation). If a project called `rg` comes around, they can appeal to moderators to get this name, and probably succeed (as if this were a #3 problem).

This isn't a perfect way to do things by any means, but it seems like a decent balance of concerns to me.

Post reply on HN