Hacker News Reader

Comment by jackgavigan | Hacker News Reader

Someone has created a Rust crate called libra, which claims to be a "Simple fantasty Adventure MUD" (sic). It's currently just a "Hello, world!" program.

What are the chances it's a placeholder for malicious/trojan code intended to steal Libra coins? (c.f. the event-stream backdoor[2])

[1] https://crates.io/crates/libra

[2] https://news.ycombinator.com/item?id=18534392

View on HN

Global unqualified namespace is a classic mistake. Causes all sorts of silly "squatting" and drama issues.

Should really be:

    https://crates.io/crates/someorg/libra
    https://crates.io/crates/facebook/libra

People like unqualified names because it's slightly cute, though.

I have been enjoying how npm is addressing this with @organization/project. Makes using npm a little less awful these days.

The argument I saw was that a global namespace ensured:

A) Packages can change owners without changing names (and breaking downstreamers)

B) It encourages creative names, rather can calling something myusername/http, you have to give the package a real name like hyper, express, curl, etc.

> B) It encourages creative names

Who wants this?

Empirically, libraries with unique names are more popular than ones that aren’t. It helps to have a unique name when searching, they’re more memorable, it’s easier to disambiguate between two libraries that do similar things, etc.

> Empirically, libraries with unique names are more popular than ones that aren’t.

Seems like this is survivorship bias. All of the common names get squatted by people who never push code, and then anyone who's actually going to build something will need to pick something unique.

Reqwest is more popular than request, for example. It's not exactly what most would expect, and if you search "request" you get the much less popular crate.

This is true even in ecosystems that have namespacing. And in hybrid systems, like npm’s, the non-namespaces versions are almost universally more popular than the namespaced ones.

Interesting, but I wonder how this works in purely namespaced systems - if non standard names are more popular in, say, maven.

I don't know. I'm unconvinced that this is a meaningful metric, and I worry more about typosquatting/ malicious dependencies, which, to my knowledge, crates.io does almost nothing to proactively deal with.

Namespacing doesn’t solve typosquatting or malicious dependencies. You typosquat the namespace instead. Any dependency can become malicious.

Yeah, you're right.

But A) you could still implement giving ownership to another user without giving the other user your whole namespace and B) why would you even want B?

If you give ownership without changing the organization that owns the package it then signals trust..

Usually, orgs won't be comfortable with this..

(B) is brilliant... We all know what EC2 and S3 is... If Amazon had just called these services for: compute and storage, there wouldn't be any brand.

Branding makes things easier to search for and to talk about.

All this said, these downsides might be worth it

npm install @aws/s3 works for me.

npm install burrito doesn't.

Looks like the repo and github account were made today. [1] That’s pretty fishy to me.

Crates.io has all sorts of other problems where it assumes good faith.

[1]: https://github.com/kollaborator

Can't Facebook call it something like FB.Libra?

A dot is not allowed, but they could use a dash or underscore.

Reply on news.ycombinator.com