# Are there publishing rules on crates.io? **URL:** \ **Category:** tools and infrastructure\ **Created:** [February 20, 2023, 11:56am UTC](https://internals.rust-lang.org/t/are-there-publishing-rules-on-crates-io/18380 "2023-02-20T11:56:35Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![hydroper1](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/hydroper1/32/12099_2.png) [@hydroper1](https://internals.rust-lang.org/u/hydroper1)\ **Post date:** [February 20, 2023, 11:56am UTC](https://internals.rust-lang.org/t/are-there-publishing-rules-on-crates-io/18380/1 "2023-02-20T11:56:35Z")
For example, is it allowed to post some crate named `v ***** `? Is it allowed to show sexual pictures in the crate's `README`? The Cargo "publishing" documentation doesn't prohibit any of this, so I can use whatever name and whatever `README`, right? Overworked volunteers of [crates.io](http://crates.io) only take action on edge cases. There's no moderation (even if _little_), so you've right to do anything. ---
**Author:** ![user16251](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/user16251/32/10186_2.png) [@user16251](https://internals.rust-lang.org/u/user16251)\ **Post date:** [February 20, 2023, 12:10pm UTC](https://internals.rust-lang.org/t/are-there-publishing-rules-on-crates-io/18380/2 "2023-02-20T12:10:26Z")
Your hypotheticals sound like they would violate the Rust code of conduct, but I can't speak for the [crates.io](http://crates.io) moderators. Compare the [pypi](https://pypi.org/policy/acceptable-use-policy/) policy with the [Rust](https://crates.io/policies) policy. I think the Python policies are more straightforward. ---
**Author:** ![hydroper1](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/hydroper1/32/12099_2.png) [@hydroper1](https://internals.rust-lang.org/u/hydroper1)\ **Post date:** [February 20, 2023, 12:15pm UTC](https://internals.rust-lang.org/t/are-there-publishing-rules-on-crates-io/18380/3 "2023-02-20T12:15:18Z")
Sure; but even if crate name or `README` breaks the policies, there are no moderators. I've been told that some folks that manage [crates.io](http://crates.io) only take action on very specific cases. So these folks won't do _even_ little. So what I understand is that I can finely break that code of conduct. For example, if they add a feature of namespaces, but not as the _crates as namespaces_ proposal, if someone illegally takes ownership of a namespace that shouldn't belong to them, no little will do the few folks that manage [crates.io](http://crates.io). Plus, this illegal "ownership" thing doesn't happen "frequently"; it's very, very, very rare; so no need of frequent moderators. ---
**Author:** ![Nemo157](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/nemo157/32/11585_2.png) [@Nemo157](https://internals.rust-lang.org/u/Nemo157)\ **Post date:** [February 20, 2023, 12:21pm UTC](https://internals.rust-lang.org/t/are-there-publishing-rules-on-crates-io/18380/4 "2023-02-20T12:21:44Z")
I think it would largely depend on context. There is a whole ecosystem of crates for teledildonics centered around `https://crates.io/crates/buttplug` (may be NSFW depending on your specific SFW policies). Personally I don't find the pypi policy that much more straightforward > We do not allow content or activity on PyPI that: > > - is sexually obscene or relates to sexual exploitation or abuse, including of minors; What is the level that causes content to become "obscene" (which culture's values are used to derive this level)? ---
**Author:** ![user16251](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/user16251/32/10186_2.png) [@user16251](https://internals.rust-lang.org/u/user16251)\ **Post date:** [February 20, 2023, 4:01pm UTC](https://internals.rust-lang.org/t/are-there-publishing-rules-on-crates-io/18380/6 "2023-02-20T16:01:30Z")
The pypi policy goes into much greater detail later in the document. ---
**Author:** ![Heliozoa](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/heliozoa/32/7029_2.png) [@Heliozoa](https://internals.rust-lang.org/u/Heliozoa)\ **Post date:** [February 20, 2023, 6:18pm UTC](https://internals.rust-lang.org/t/are-there-publishing-rules-on-crates-io/18380/7 "2023-02-20T18:18:26Z")
> [@hydroper1](#): > > I've been told that some folks that manage [crates.io](http://crates.io) only take action on very specific cases. I think you've misunderstood something, I'm sure breaking the rules is one of such specific cases. ---
**Author:** ![hydroper1](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/hydroper1/32/12099_2.png) [@hydroper1](https://internals.rust-lang.org/u/hydroper1)\ **Post date:** [February 20, 2023, 6:24pm UTC](https://internals.rust-lang.org/t/are-there-publishing-rules-on-crates-io/18380/8 "2023-02-20T18:24:05Z")
Quote: > [@](#): > > [Crates.io](http://Crates.io) has a team of overworked volunteers who only take action in extreme cases like [crates.io](http://crates.io) being used to distribute malware or responding to legal orders. ---
**Author:** ![user16251](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/user16251/32/10186_2.png) [@user16251](https://internals.rust-lang.org/u/user16251)\ **Post date:** [February 20, 2023, 6:34pm UTC](https://internals.rust-lang.org/t/are-there-publishing-rules-on-crates-io/18380/9 "2023-02-20T18:34:48Z")
Is there some context for your question? ---
**Author:** ![hydroper1](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/hydroper1/32/12099_2.png) [@hydroper1](https://internals.rust-lang.org/u/hydroper1)\ **Post date:** [February 20, 2023, 6:41pm UTC](https://internals.rust-lang.org/t/are-there-publishing-rules-on-crates-io/18380/10 "2023-02-20T18:41:07Z")
It's due to a recent proposal of mine about supporting crate domains on [crates.io](http://crates.io). Someone told any user could take illegal ownership over a domain, which is a _rare_ edge case, even though which is also a legality issue? My proposal of domains and URI crates has a goal similiar to the proposal: [Pre-RFC: Packages as Optional Namespaces](https://internals.rust-lang.org/t/pre-rfc-packages-as-optional-namespaces/13059) ---
**Author:** ![Heliozoa](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/heliozoa/32/7029_2.png) [@Heliozoa](https://internals.rust-lang.org/u/Heliozoa)\ **Post date:** [February 20, 2023, 6:42pm UTC](https://internals.rust-lang.org/t/are-there-publishing-rules-on-crates-io/18380/11 "2023-02-20T18:42:03Z")
I don't think they were intending on enumerating all possible cases that the moderation team will take action on. I'm not aware of any cases where rule-breaking crates have been reported and the reports have been ignored. ---
**Author:** ![jhpratt](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/jhpratt/32/11640_2.png) [@jhpratt](https://internals.rust-lang.org/u/jhpratt)\ **Post date:** [February 20, 2023, 6:59pm UTC](https://internals.rust-lang.org/t/are-there-publishing-rules-on-crates-io/18380/12 "2023-02-20T18:59:47Z")
To be honest, I don't think hypothetical questions like this pose any value. There is obviously a level of common sense used when a crate is reported. ---
**Author:** ![hydroper1](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/hydroper1/32/12099_2.png) [@hydroper1](https://internals.rust-lang.org/u/hydroper1)\ **Post date:** [February 20, 2023, 7:06pm UTC](https://internals.rust-lang.org/t/are-there-publishing-rules-on-crates-io/18380/13 "2023-02-20T19:06:47Z")
Yes, but like said before, there's no one getting paid for this and they said... there's no one to work on resolving even edge problems like illegal package name ownership. So... it means I can do whatever. Once I take a name that doesn't belong to me, there will be no moderator to take over me if I'm using it illegally. Right? For example, if I publish an empty stub crate with the name `azure`, it's gone; it belongs _to_ me. `azure` would normally belong to Microsoft, but they didn't use [crates.io](http://crates.io) at the moment. What if I lose access to my [crates.io](http://crates.io) account and can't pass ownership to anyone else? Or what if I don't want to pass ownership and be a bad person? That's just an example (not concrete). And so, after all, my crate domain proposal was taken down because of something like this explained above. If [crates.io](http://crates.io) is self-service at extreme, then I can create a crate \*\*\*\*\* and \*. ---
**Author:** ![Nemo157](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/nemo157/32/11585_2.png) [@Nemo157](https://internals.rust-lang.org/u/Nemo157)\ **Post date:** [February 20, 2023, 7:13pm UTC](https://internals.rust-lang.org/t/are-there-publishing-rules-on-crates-io/18380/14 "2023-02-20T19:13:41Z")
> [@hydroper1](#): > > or responding to legal orders. > [@hydroper1](#): > > there will be no moderator to take over me if I'm using it illegally No, as you said earlier [crates.io](http://crates.io) operators will respond to legal orders. If you for example commit trademark infringement and the trademark owner gets a legal order for [crates.io](http://crates.io) to remove the crate they will. ---
**Author:** ![hydroper1](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/hydroper1/32/12099_2.png) [@hydroper1](https://internals.rust-lang.org/u/hydroper1)\ **Post date:** [February 20, 2023, 7:14pm UTC](https://internals.rust-lang.org/t/are-there-publishing-rules-on-crates-io/18380/15 "2023-02-20T19:14:36Z")
> [@Nemo157](#): > > No, as you said earlier [crates.io](http://crates.io) operators will respond to legal orders. If you for example commit trademark infringement and the trademark owner gets a legal order for [crates.io](http://crates.io) to remove the crate they will. Then why was my domain proposal underrated for that? The moderators would just remove the domain. ---
**Author:** ![Heliozoa](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/heliozoa/32/7029_2.png) [@Heliozoa](https://internals.rust-lang.org/u/Heliozoa)\ **Post date:** [February 20, 2023, 7:15pm UTC](https://internals.rust-lang.org/t/are-there-publishing-rules-on-crates-io/18380/16 "2023-02-20T19:15:23Z")
> [@hydroper1](#): > > For example, if I publish an empty stub crate with the name `azure`, it's gone; it belongs _to_ me. `azure` would normally belong to Microsoft, but they didn't use [crates.io](http://crates.io) at the moment. What if I lose access to my [crates.io](http://crates.io) account and can't pass ownership to anyone else? Or what if I don't want to pass ownership and be a bad person? That's just an example (not concrete). Then nothing. It's not against the rules of [crates.io](http://crates.io) let alone illegal, Microsoft can use `microsoft-azure`, `azure-rs` or whatever. If your actual intent is to just talk about your proposal again (which had many good reasons to be rejected) I suspect this thread will get locked just like the previous ones. ---
**Author:** ![hydroper1](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/hydroper1/32/12099_2.png) [@hydroper1](https://internals.rust-lang.org/u/hydroper1)\ **Post date:** [February 20, 2023, 7:17pm UTC](https://internals.rust-lang.org/t/are-there-publishing-rules-on-crates-io/18380/17 "2023-02-20T19:17:57Z")
> [@Heliozoa](#): > > Then nothing. It's not against the rules of [crates.io](http://crates.io) let alone illegal, Microsoft can use `microsoft-azure`, `azure-rs` or whatever. This should change, otherwise Rust will have a complicated future in [crates.io](http://crates.io). ---
**Author:** ![Nemo157](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/nemo157/32/11585_2.png) [@Nemo157](https://internals.rust-lang.org/u/Nemo157)\ **Post date:** [February 20, 2023, 7:18pm UTC](https://internals.rust-lang.org/t/are-there-publishing-rules-on-crates-io/18380/18 "2023-02-20T19:18:19Z")
As far as I recall the discussion this wasn't a reason anyone had against your proposal. Someone using a "[crates.io](http://crates.io) domain" which overlapped with an Internet domain name (since you explicitly rejected validation of the domains back to Internet domain names) isn't in itself a trademark infringement. There is a wide gray area in which there's no illegality involved but the names are ambiguous and the domain name form of them gives a stronger chance for mistaken identity (someone is more likely to think `microsoft.com/azure` is owned by Microsoft than `microsoft-azure`). ---
**Author:** ![hydroper1](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/hydroper1/32/12099_2.png) [@hydroper1](https://internals.rust-lang.org/u/hydroper1)\ **Post date:** [February 20, 2023, 7:20pm UTC](https://internals.rust-lang.org/t/are-there-publishing-rules-on-crates-io/18380/19 "2023-02-20T19:20:04Z")
Yes, I thought of this ambiguity. I was mostly inspired by XML namespaces, which use URIs, but not "HTTP" URIs... ---
**Author:** ![hydroper1](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/hydroper1/32/12099_2.png) [@hydroper1](https://internals.rust-lang.org/u/hydroper1)\ **Post date:** [February 20, 2023, 7:22pm UTC](https://internals.rust-lang.org/t/are-there-publishing-rules-on-crates-io/18380/20 "2023-02-20T19:22:05Z")
I'm still up for the other proposal using packages as optional namespaces, but the issue of [crates.io](http://crates.io) moderation still sucks. They said the minor team of [crates.io](http://crates.io) won't do anything regarding unused crates... This kind of moderation I'm talking about isn't simply deleting unused crates, too; it involves author contact etc. By the discussion in my previous proposal, what I understand is that they'll never do anything about an unreachable crate. ---
**Author:** ![hydroper1](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/hydroper1/32/12099_2.png) [@hydroper1](https://internals.rust-lang.org/u/hydroper1)\ **Post date:** [February 20, 2023, 7:26pm UTC](https://internals.rust-lang.org/t/are-there-publishing-rules-on-crates-io/18380/21 "2023-02-20T19:26:03Z")
Unrelated comment, but I think namespaces over "packages as namespaces" are better as it distinguishes crates from [crates.io](http://crates.io) namespaces. For example, you distinguish `microsoft` namespace from `microsoft` crate. [Next page](https://internals.rust-lang.org/t/are-there-publishing-rules-on-crates-io/18380.md?page=2)