Fun fact: It appears that Yandex uploads thousands of placeholders for every internal package name in order to prevent this from happening: https://pypi.org/search/?q=yandex+AND+%22dependency+confusio...
Surely that is not the only viable defense?
Surely that is not the only viable defense?
“A project published on the Package Index meeting [...] the following is considered invalid and will be removed from the Index: [...] project is name squatting (package has no functionality or is empty);”
although the enforcement of that rule is lax in general, not only in this instance[2].
[1] https://peps.python.org/pep-0541/#invalid-projects
[2] e.g. https://pypi.org/project/requests3/ off the top of my head
Certainly it isn't "squatting" in the typical sense of "prevent someone else from using a valuable name".
* There is no namespaces, so all internal packages must be individually protected * It's easy to misconfigure the various python package tools to open you up to dependency confusion attacks * The only effective protection mechanism that you can implement across a large enterprise fills the index with spam and is forbidden
It would really improve things if they could introduce namespaces and let legal entities own those.
That’s not a perfect solution, but so far that DNS is the namespace with mainstream acceptance and builtin lawyers that a single entity cannot e.g. just singlehandedly sanction, sue or simply “reserve the right to refuse” people out of—in practice, for the most part.
PyPI’s (and CPAN’s, CTAN’s, Hackage’s, NPM’s) centralized index was originally a (deliberately) crude solution to the discoverability problem, at least in part. These days, we have adopted a different bad solution—putting everything on a Microsoft-owned hosting service with a crap search function. That is also quite bad, but maybe it’s time we recognize it happened anyway and stop making concessions to the old solutions in our package naming schemes.
Package registries need to address this, as even the newest and "modern" ones keep repeating the same mistakes (yes, I'm looking at you cargo/crates).
Just add a damn namespace, where packages have to be under in order to be publicly available. Would solve the problem yesterday, but instead new registries with global names keep appearing like it's not a problem.
In the case of heavy moderated ones like Debian et al, it makes sense with a global namespace, but for the ones anyone can upload a package? Require namespaces already...
https://learn.microsoft.com/en-us/nuget/nuget-org/id-prefix-...
NPM has scopes:
https://docs.npmjs.com/about-scopes
So there are ways to make package repositories prevent squatting on package names.
It doesn't look like the fixing effort is progressing very quickly: https://github.com/pypa/pip/issues/8606
To their credit, at least they didn't close it "works as intended" which I imagine a lot of projects would.