News for hackers. Stuff that matters.
Re:Malicious code in the purescript NPM installer by twic on Sunday July 28, 2019 @05:16PM (#20549883)
cargo, at least, does this for the reason Fellshard gives - the Rust team essentially commissioned a copy of Ruby's bundler, without considering whether there was anything to learn from any other language's ecosystem.
Re:Malicious code in the purescript NPM installer by geofft on Sunday July 28, 2019 @05:19PM (#20549896)
Well, okay, if your point of view is that behaving like multiple other major languages and specifically taking the lessons (good and bad) of a specific existing language ecosystem into account before doing your own thing is the same as disregarding other languages and reinventing the wheel, I'm not sure what words mean anymore.
Re:Malicious code in the purescript NPM installer by twic on Monday July 29, 2019 @05:19AM (#20552771)
> Well, okay, if your point of view is that behaving like multiple other major languages and specifically taking the lessons (good and bad) of a specific existing language ecosystem into account before doing your own thing is the same as disregarding other languages

If you've only looked at two or three languages that not coincidentally happen to do things pretty much the same as each other, and not looked elsewhere, then you are indeed disregarding other languages.

> and reinventing the wheel

I didn't mention reinventing the wheel.

> I'm not sure what words mean anymore.

Agreed, but i'm not sure i can help you with that.

Re:Malicious code in the purescript NPM installer by steveklabnik on Sunday July 28, 2019 @09:57PM (#20550933)
Cargo is more like npm than Bundler in this regard, as Bundler does not let you have multiple versions of a package at the same time. That lesson was learned from npm, though implemented in a different way.
Re:Malicious code in the purescript NPM installer by kibwen on Sunday July 28, 2019 @06:47PM (#20550245)
Namespaces would be a feature of Crates.io, not Cargo (and Crates.io was not contracted to Yehuda Katz, as Cargo was).
Re:Malicious code in the purescript NPM installer by twic on Monday July 29, 2019 @05:21AM (#20552786)
How so? Do you mean that Cargo would support crates with names like "example/foo" or "org.example/foo", but that's just not how Crates.io works?

If so, that's interesting, but then my question is why we didn't make use of that.

Re:Malicious code in the purescript NPM installer by steveklabnik on Monday July 29, 2019 @12:04PM (#20556017)
There's a few different elements of the design space. But, while Cargo can use crates.io, it's distinct from it, so on first principle, this would be a crates.io feature.

That being said, Cargo would also have to understand it, because the Rust language does not understand namespaced external packages, so you'd either have to change the language, or change Cargo to do something to paper over that somehow.

As for "why didn't we do this in the first place with crates.io", https://internals.rust-lang.org/t/crates-io-package-policies... lays out some of this background, though not all of it.

Re:Malicious code in the purescript NPM installer by twic on Monday July 29, 2019 @12:44PM (#20556543)
Thanks for the reference!

> When we looked at package ecosystems without namespacing, we found that people tended to go with more creative names (like nokogiri instead of “tenderlove’s libxml2”). These creative names tend to be short and memorable, in part because of the lack of any hierarchy. They make it easier to communicate concisely and unambiguously about packages. They create exciting brands.

I will never stop admiring your ability to see the bright side of things.