An analysis of module names inside top PyPI packages

Re:An analysis of module names inside top PyPI packages by remram on Thursday July 11, 2024 @11:52AM (#40937975)

That doesn't fix the problem, that just makes it so every package now has a random prefix. Instead of having to know that "yaml" is provided by "pyyaml", you will have to know it's "ingy/yaml".

[ Parent | on HN ]

Re:An analysis of module names inside top PyPI packages by bangaladore on Thursday July 11, 2024 @02:46PM (#40939418)

Sure, but combined with other methods, you get something much better.

Maybe I invent a protocol today called "hitta" and make a new package called

"hitta"

I'm pretty much automatically going to be the de facto standard, even if better, more updated implementations exist. Names matter.

But if my implementation is called

hittaorg/hitta

Organizations and users (publishers) can be verified, and the tools integrate correctly; you gain better package context, increase trust, and reduce supply chain risks.

Now, if user123 has a better version, they might make

user123/hitta

Instead of

pyhitta-with-new-features

or whatever garbage is used today

[ Parent | on HN ]

Re:An analysis of module names inside top PyPI packages by remram on Thursday July 11, 2024 @04:27PM (#40940335)

You mean to encourage other user to make other packages with the same import name? Big no from me. This is taking us backwards!

And I don't understand what's preventing users and organization from being verified now?

[ Parent | on HN ]