Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“You meant to install ripgrep”

crates.io

Post reply on HN
Print view View original

41–50 of 165 posts

Re: “You meant to install ripgrep”

#41

Post by maxbond »

Macha wrote: post #40
maxbond wrote: post #30

Earlier quoted context omitted.

I'd like to note there are three perverse incentives that lead to abuses of public namespaces (that I am aware of - please tell me if I've missed any): 1.) The use of names as a speculative financial instrument (in all shades of grey, up to and including extortion for lapsed or stolen names) 2.) The use of names as vectors of attack, such as by exploiting typos or homographs (such as malicious packages) 3.) The reser…

> #3 is a problem to some degree on crates.io, my understanding is that they basically treat this as a human moderation problem I think it's more accurate to say that they consider dealing with this out of scope. "I want this name that has been unused since it was added as a placeholder package 7 years ago" is not something that the human moderation will help you with. The extent of human moderation on crates.io is b…

Gotcha, that was a misunderstanding on my part. Thanks.

Re: “You meant to install ripgrep”

#43

Post by Macha »

burntsushi wrote: post #36
sedatk wrote: post #32

Earlier quoted context omitted.

I guess "owner/packagename" convention could solve such issues as it's common with other package ecosystems.

Right. So then you add burnsushi/ripgrep instead. See the problem? Namespaces are a solution or mitigation to some problem, but that problem is not malicious typo-squatting.

To me the problem solved by namespaces is making it clear what's an official package of a project and what's a non-malicious third party package intended to work with that project.

e.g. bevy and amethyst have claimed a load of crate names like bevy-x or amethyst_y because they thought they might release an official addon to their framework to handle those areas. e.g. bevy did it with this https://github.com/bevyengine/bevy-crate-reservations/blob/m... and amethyst did it the long way as far as I know

Organisations wanting to have consistent package names and users wanting to identify related packages are smaller problems than the "all the good names are taken" and "packages can impersonate other packages with typos" problems.

Re: “You meant to install ripgrep”

#44

Post by wincy »

burntsushi wrote: post #3

Hah! TIL. I had no idea someone did this. But it's smart. I should have thought of it! (I'm the author of ripgrep.)

I use ripgrep on git bash for Windows, and my team members act like I’ve got searching superpowers. Searching on windows is such a pain and this makes it easy. Thanks so much for making this fantastic tool!

Re: “You meant to install ripgrep”

#45

Post by tomjakubowski »

woodruffw wrote: post #9
seanw444 wrote: post #4

Is there no way to have a package mirror, or alias or something? Unless I'm missing a joke or something, this seems like an easily solvable problem.

Aliases turn a flat namespace into a potentially cyclical graph, and introduce all kinds of permission considerations (Should a non-owner be able to alias a project? If so, should they be allowed to update it?). The solutions here are non-flat namespacing (which has worse UX, since `cargo install some-tool` now becomes `cargo install whats-their-handle-again/some-tool`) or some kind of content addressing (which is si…

Clojars has the right idea for namespacing: some-tool is an alias for some-tool/some-tool.

This means the first package to squat on the name can use the shorthand version, while allowing other packages with the same name in other namespaces. (which may be forks or entirely different packages)

Re: “You meant to install ripgrep”

#46

Post by steveklabnik »

woodruffw wrote: post #14

This classic version of this in the Ruby ecosystem is "bundle"[1], which helpfully installs `bundler` for you. Of the 6.7 million downloads it has, I'm probably in there a dozen or so times. [1]: https://rubygems.org/gems/bundle

There’s also “nokogirl”

Re: “You meant to install ripgrep”

#47

Post by burntsushi »

Macha wrote: post #43
burntsushi wrote: post #36

Earlier quoted context omitted.

Right. So then you add burnsushi/ripgrep instead. See the problem? Namespaces are a solution or mitigation to some problem, but that problem is not malicious typo-squatting.

To me the problem solved by namespaces is making it clear what's an official package of a project and what's a non-malicious third party package intended to work with that project. e.g. bevy and amethyst have claimed a load of crate names like bevy-x or amethyst_y because they thought they might release an official addon to their framework to handle those areas. e.g. bevy did it with this https://github.com/bevyengin…

I'm not sure I necessarily agree with that... But yeah I specifically did not want to get into what namespaces do solve, and so was instead vague and just acknowledged that they're good for something. :-)

I will also say this: at the level of personal preference, and given my understanding of many other package ecosystems, I would have preferred namespaces from the start. But I don't feel very strongly one way or the other to be honest.

There is a related RFC open: https://github.com/rust-lang/rfcs/pull/3243

> "packages can impersonate other packages with typos" problems

I was pointing out that this is specifically not solved at all by namespacing. A package's name includes its namespace, and the namespace can be typo-squatted. (EDIT: Or wait, maybe I'm misunderstanding what you're saying. Perhaps I'm confused by what "these" refers to in your last sentence.)

Re: “You meant to install ripgrep”

#48

Post by OJFord »

meowface wrote: post #16
salawat wrote: post #10

Earlier quoted context omitted.

You should not have done this unless you want to further normalize the practice of namespace squatting. This is the same type of behavior leads to domain squatting. While arguably being slightly more benign in the sense of hedging against typosquatting, if everyone started going things like that, we'd quickly begin to run into namespace exhaustion problems as people started ballooning their package namespace footprin…

I think this is akin to saying nytimes.com buying nyt.com and redirecting it to nytimes.com is domain squatting.

Someone else already has 'nyt.com' ('rg'), GP is saying (not saying I agree) 'nytimes.com' ('ripgrep') behaviour encourages other someone elses to do that sort of squatting, where they don't own the thing that is clearly intended.

Re: “You meant to install ripgrep”

#49

Post by burntsushi »

wincy wrote: post #44
burntsushi wrote: post #3

Hah! TIL. I had no idea someone did this. But it's smart. I should have thought of it! (I'm the author of ripgrep.)

I use ripgrep on git bash for Windows, and my team members act like I’ve got searching superpowers. Searching on windows is such a pain and this makes it easy. Thanks so much for making this fantastic tool!

Hah, w00t. Have your teammates figured out that your superpowers are teachable? :-)

Re: “You meant to install ripgrep”

#50

Post by OJFord »

walthamstow wrote: post #27
remram wrote: post #11

Similar in the Python world: https://pypi.org/project/sklearn/ This one just depends on the correct `scikit-learn` package though.

Also bs4 / beautifulsoup4

These are both like numpy & pandas in always documenting with `import longname as ln` right? I think they bring it on themselves.
Post reply on HN