Python typosquatting is about more than typos

Re:Python typosquatting is about more than typos by duskwuff on Friday October 02, 2020 @05:05PM (#24667023)

The "1g" in "zlib1g" is a version. Dynamic libraries can have multiple versions which can be installed in parallel. zlib hasn't changed much lately, so there's only really one version that matters, but this does come into play for other libraries. For example, LibUSB has libusb-0.1 and libusb-1.0, both of which are widely used.

librust-libz-sys-dev is a Debian package for a Rust library that's literally called "libz-sys" [1]. Why the developers of this package decided to call it this and not "zlib" is a question for them, but Debian packages libraries based on the language's own name for the package, not its own reinterpretation of those names.

[1]: https://crates.io/crates/libz-sys

[ Parent | on HN ]

Re:Python typosquatting is about more than typos by steveklabnik on Friday October 02, 2020 @08:20PM (#24668375)

https://doc.rust-lang.org/cargo/reference/build-scripts.html...

[ Parent | on HN ]

Re:Python typosquatting is about more than typos by bigbubba on Friday October 02, 2020 @05:22PM (#24667154)

The mingw package (libz-mingw-w64) also has it backwards. As far as I can tell, that upstream gets it right ('mingw-w64-x86_64-zlib' I believe.)

Also, putting version number suffixes on package names when the package system already has a concept of version numbers never sat right with me. It seems like a hack around tooling deficiencies.

[ Parent | on HN ]

Re:Python typosquatting is about more than typos by duskwuff on Friday October 02, 2020 @06:16PM (#24667605)

The Debian packaging system only allows one version of a package to be installed at a time, as it assumes that a newer version of a package will contain substantially the same files as a previous version. Versioned libraries install different files, and can be installed alongside each other.

[ Parent | on HN ]