News for hackers. Stuff that matters.
Re:Malicious code in the purescript NPM installer by kibwen on Sunday July 28, 2019 @06:47PM (#20550245)
Namespaces would be a feature of Crates.io, not Cargo (and Crates.io was not contracted to Yehuda Katz, as Cargo was).
Re:Malicious code in the purescript NPM installer by twic on Monday July 29, 2019 @05:21AM (#20552786)
How so? Do you mean that Cargo would support crates with names like "example/foo" or "org.example/foo", but that's just not how Crates.io works?

If so, that's interesting, but then my question is why we didn't make use of that.

Re:Malicious code in the purescript NPM installer by steveklabnik on Monday July 29, 2019 @12:04PM (#20556017)
There's a few different elements of the design space. But, while Cargo can use crates.io, it's distinct from it, so on first principle, this would be a crates.io feature.

That being said, Cargo would also have to understand it, because the Rust language does not understand namespaced external packages, so you'd either have to change the language, or change Cargo to do something to paper over that somehow.

As for "why didn't we do this in the first place with crates.io", https://internals.rust-lang.org/t/crates-io-package-policies... lays out some of this background, though not all of it.

Re:Malicious code in the purescript NPM installer by twic on Monday July 29, 2019 @12:44PM (#20556543)
Thanks for the reference!

> When we looked at package ecosystems without namespacing, we found that people tended to go with more creative names (like nokogiri instead of “tenderlove’s libxml2”). These creative names tend to be short and memorable, in part because of the lack of any hierarchy. They make it easier to communicate concisely and unambiguously about packages. They create exciting brands.

I will never stop admiring your ability to see the bright side of things.