Re:Malicious code in the purescript NPM installer
by geofft on Sunday July 28, 2019 @11:40PM
(#20551357)
> Why would anyone who owns a namespace be willing to leave a package that's moving to another maintainer within their own namespace? A namespace tends to come with a reputation, and if you give an outsider access to the namespace, the reputation can change without the owner's consent. No, I don't think....
Good first-principles argument, but in practice, this happens in ecosystems that do have namespaced packages. Off the top of my head:
- Until recently, kennethreitz was a GitHub organization so other people could manage kennethreitz/requests etc.
- Foursquare's Android app is still com.joelapenna.foursquared, which originally was a third-party app that got adopted by Foursquare and turned into their official app. Joe never worked for Foursquare.
Good first-principles argument, but in practice, this happens in ecosystems that do have namespaced packages. Off the top of my head:
- Until recently, kennethreitz was a GitHub organization so other people could manage kennethreitz/requests etc.
- Foursquare's Android app is still com.joelapenna.foursquared, which originally was a third-party app that got adopted by Foursquare and turned into their official app. Joe never worked for Foursquare.
- When Linus took a break from Linux development for 4.19, Greg K-H still released it from https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin... and https://github.com/torvalds/linux .