Remote Code Execution Vulnerability in Google They Are Not Willing to Fix

Re:Remote Code Execution Vulnerability in Google They Are No... by matheusmoreira on Saturday April 15, 2023 @05:47PM (#35584886)

I think all packages should be namespaced per user. The language's core team could promote widely used packages to a "standard" namespace and give it a good name that way, thereby making it the "canonical" implementation of something.

[ Parent | on HN ]

Re:Remote Code Execution Vulnerability in Google They Are No... by ilyt on Saturday April 15, 2023 @06:55PM (#35585474)

I dunno how ecosystems keep making the same mistake.

All so someone can save few letters with typing dep name that one time they will be pulling it in into their project

[ Parent | on HN ]

Re:Remote Code Execution Vulnerability in Google They Are No... by dgellow on Sunday April 16, 2023 @06:08AM (#35588682)

The lack of namespacing in Rust is so weird. The discussion has been going for years, but it makes zero sense to me that after seeing issues npm and pypi faced during the past decade Rust is still pushing back against a more structured registry structure. Squatting will become more and more problematic the longer this flat registry approach persists.

[ Parent | on HN ]