Hacker News Reader

Comment by eudox | Hacker News Reader

I'm a fan of the approach of personally submitting projects to the repository maintainer (e.g. through GitHub issues), and having the maintainer personally approve them.

It does raise the barrier to entry, but it would prevent typosquatting and regular namesquatting.

EDIT: Does any major package manager provide a "did you mean" functionality, offering a list of actual package names similar to what you typed?

View on HN

then the maintianer must have perfcet sigth and never ovrelook even one tpyo :]

and then also have perfect memory of all packages and notice that similarly named package is too (for some value of "too") similarly named to some already existing one... even if e.g. both are a correct dictionary word.

APT does and others probably do too, but it obviously only gives suggestions when the package you entered doesn't exist.

Right, it's only useful if you've prevented typosquatting.

Which Debian has, because submitting a new package is a much more involved processes than sudo apt-get publish.

That's a massive burden on the poor person who has to ok the package - especially at NPM's scale, for example.

Well, ideally you'd set up some sort of system where multiple people work on managing a repository, similar to maybe how linux distributions package applications and libraries.

NPM's scale is the exception, rather than the rule.

We believe npm's scale is a direct result of having the lowest ceremony to publish a package. Turning the dial in the direction we did has pros and cons.

Or someone needs to approve suspiciously named packages.

How do you determine what is a suspicious package without reviewing every new package by hand?

You could base it off edit distance with all the other packages. If the distance is too close, then it needs manual approval.

Reply on news.ycombinator.com