Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“You meant to install ripgrep”

crates.io

Post reply on HN
Print view View original

31–40 of 165 posts

Re: “You meant to install ripgrep”

#31

Post by Arnavion »

taink wrote: post #8
dtolnay wrote: post #5

Earlier quoted context omitted.

Seems like it would be better to contain: compile_error!("You meant to …"); so that the install would fail and `cargo uninstall rg` wouldn't be needed.

Can always-failing-to-compile crates be deployed to the registry?

crates.io doesn't try to build crates. It couldn't do that anyway. Crates can require arbitrary C library dependencies, only run on some specific targets, etc. That's why docs.rs has to make some effort to be able to build crates, and even it doesn't get all of them.

Re: “You meant to install ripgrep”

#32

Post by sedatk »

jfk13 wrote: post #25

Huh - the same author also has https://crates.io/crates/memap and memap2, which explicitly say that they're "squatting to prevent a malicious typo package". Not sure how to feel about this... on an individual-package level, it seems a sensible enough idea, but if it becomes a widespread practice, the namespace could get really cluttered.

I guess "owner/packagename" convention could solve such issues as it's common with other package ecosystems.

Re: “You meant to install ripgrep”

#33

Post by oconnor663 »

taink wrote: post #8
dtolnay wrote: post #5

Earlier quoted context omitted.

Seems like it would be better to contain: compile_error!("You meant to …"); so that the install would fail and `cargo uninstall rg` wouldn't be needed.

Can always-failing-to-compile crates be deployed to the registry?

Yes, `cargo publish` has the `--no-verify` flag if you want to force this. I think all the verification is client-side.

Re: “You meant to install ripgrep”

#34

Post by burntsushi »

BossingAround wrote: post #29
burntsushi wrote: post #3

Hah! TIL. I had no idea someone did this. But it's smart. I should have thought of it! (I'm the author of ripgrep.)

Would you consider taking the "rg" package and redirecting people to ripgrep? I mean, asking the current owner to kindly donate it to you.

Yes, I'd be fine with that. I just spent a few minutes looking for their contact info, but I can't find it.

EDIT: Found their email via git. Always forget about that one.

Re: “You meant to install ripgrep”

#35

Post by Macha »

sedatk wrote: post #32
jfk13 wrote: post #25

Huh - the same author also has https://crates.io/crates/memap and memap2, which explicitly say that they're "squatting to prevent a malicious typo package". Not sure how to feel about this... on an individual-package level, it seems a sensible enough idea, but if it becomes a widespread practice, the namespace could get really cluttered.

I guess "owner/packagename" convention could solve such issues as it's common with other package ecosystems.

Just moves the problem to packagename/packagename looking like a more "official" source.

Re: “You meant to install ripgrep”

#36

Post by burntsushi »

sedatk wrote: post #32
jfk13 wrote: post #25

Huh - the same author also has https://crates.io/crates/memap and memap2, which explicitly say that they're "squatting to prevent a malicious typo package". Not sure how to feel about this... on an individual-package level, it seems a sensible enough idea, but if it becomes a widespread practice, the namespace could get really cluttered.

I guess "owner/packagename" convention could solve such issues as it's common with other package ecosystems.

Right. So then you add burnsushi/ripgrep instead. See the problem?

Namespaces are a solution or mitigation to some problem, but that problem is not malicious typo-squatting.

Re: “You meant to install ripgrep”

#37

Post by [deleted] »

jfk13 wrote: post #25

Huh - the same author also has https://crates.io/crates/memap and memap2, which explicitly say that they're "squatting to prevent a malicious typo package". Not sure how to feel about this... on an individual-package level, it seems a sensible enough idea, but if it becomes a widespread practice, the namespace could get really cluttered.

[deleted]

Re: “You meant to install ripgrep”

#39

Post by samatman »

If a package manager is starting from zero, and wants to have a privileged namespace such that a short name has a canonical value, it would make sense for those packages to be able to include a list of strings which the package should also reserve.

That way "ripgrep" could include "rg", searching cargo for "rg" brings back "ripgrep", not a second package named "rg", and an install could tell the user the correct name for any attempt to install it.

This also covers typo-squats, so there would be no need for packages like "memap".

Obviously this represents a low-effort vector for massive squatting, so maintainers would need to be responsible for preventing that, and could add some typos themselves, being the ones which see the request for the mis-typed packages.

Re: “You meant to install ripgrep”

#40

Post by Macha »

maxbond wrote: post #30
salawat wrote: post #10

Earlier quoted context omitted.

You should not have done this unless you want to further normalize the practice of namespace squatting. This is the same type of behavior leads to domain squatting. While arguably being slightly more benign in the sense of hedging against typosquatting, if everyone started going things like that, we'd quickly begin to run into namespace exhaustion problems as people started ballooning their package namespace footprin…

I'd like to note there are three perverse incentives that lead to abuses of public namespaces (that I am aware of - please tell me if I've missed any): 1.) The use of names as a speculative financial instrument (in all shades of grey, up to and including extortion for lapsed or stolen names) 2.) The use of names as vectors of attack, such as by exploiting typos or homographs (such as malicious packages) 3.) The reser…

> #3 is a problem to some degree on crates.io, my understanding is that they basically treat this as a human moderation problem

I think it's more accurate to say that they consider dealing with this out of scope. "I want this name that has been unused since it was added as a placeholder package 7 years ago" is not something that the human moderation will help you with. The extent of human moderation on crates.io is basically "This is malicious or illegal and was reported to us and we looked and agreed so removed it"

Post reply on HN