Re:Backdooring Rust crates for fun and profit
by unionpivo on Friday November 19, 2021 @08:40AM
(#29276992)
Problem isn't creating namespaces.
Problem is what happens when someone claims google, amazon, and then stars doing shady stuff with it.
And maybe that somebody, was working for such organization and then left on bad terms and doesnt want to give login code or whatever.
It's not that easy problem to solve, and you need to have people on standby to resolve such issues, some of which might include layers.
Implementing namespaces in code are not even 10% of effort for this to work.
Re:Backdooring Rust crates for fun and profit
by cutemonster on Saturday November 20, 2021 @11:12AM
(#29289306)
Maybe "seek funding" (like jiggawatts wrote) is a good idea? Maybe MS and other companies would want to pay for a namespaced and identity verified Crates.io -- it's in their self interest?
Whatever the effort level is, it is certainly much lower than the thousands of Rust users navigating a tangled mess of typo squatting, name conflicts, crate spam, and difficulty in identification of official or related crates.
Again: If the crates.io team doesn't have even just this much time, then by definition they don't have the time to manage the site responsibly. They should shut it down, seek funding, or hand it over to someone else.
Doing anything else is irresponsible.