Pre-RFC: Formal squatting policy on crates.io

[RustyYato]

Previously on crate squatting:

Crates.io squatting

Example: https://crates.io/users/mahkoh Is this something that you should intervene to discourage? Or is it just part of the cut and thrust of things?

Crates.io package policies

Packages Policy for Crates.io In a previous post to the Rust blog, we announced the preview launch of crates.io, giving the Rust community a way to easily publish packages. After a few weeks of kicking the tires, and hearing the most common questions people have about the registry, we wanted to clarify the rationale behind some of the design decisions. We also wanted to take the opportunity to be more explicit about the policies around package ownership on crates.io. In general, these policies…

Some Pre-RFCs to deal with it

Pre-RFC: unique crate names

Summary Add a random and unique suffix to crate names, and allow the users to freely reserve names (except the suffix). Motivation The original name-squatting as well as the malicious typo-squatting are becoming a potential threat for the ecosystem as well as for the operations. With an unique identifier generated for each crate, these two problems can be solved without manual moderation. Guide-level explanation When you create a new crate, you will get a new name with a random suffix like “li…

Pre-eRFC: Crate name transfer

A real RFC has been opened as RFC 2614. A pre-RFC draft is preserved below. Summary This experimental RFC proposes a process by which a designated Rust team member or members could reassign ownership of a crate name on crates.​io. The aim is to identify the absolute smallest, most conservative step we can feasibly make from the status quo of crate names that can only be transferred by a current owner. The proposal is intended to address only the absolute most clear-cut situations in whi…

[Pre-RFC]: Packages as Namespaces

There’s been a lot of chatter about adding namespaces to crates.io recently, so apologies if this idea has already been discussed. Summary Allow packages to be used as namespaces in a way that is backwards compatible with the existing flat namespace. Details The owners of a crate on crates.io can add sub-crates which are referred to by the name ‘toplevelcrate/subcrate’ in Cargo.toml files. For example, instead of publishing regex-syntax, the regex maintainers could have published regex/syntax.…

Namespacing on Crates.io

I am moving this discussion here from this thread about a Crates.io incident. Why did Cargo/Crates.io choose not to namespace crates by author/organization name? Squatting for crate names would not be feasible if there was user/org namespacing. I’m not pointing fingers, pushing blame, or asking anybody to change, I’d just like to understand what the reason was for choosing not to namespace.

[Pre-RFC] Crates expropriation policy

Summary Define a policy for transferring crates ownership in the case if existing owners can not be reached. Motivation Most of the published crates have bus factor of 1, including crates with “generic” names, which users often will try first. Even today we can see examples of crate owner effective disappearance, which results in an unmaintained crate, deadlocked to the inactive owner. It leads to pollution of crates.io and negatively influences perceived quality of the crates ecosystem. It can…

Some related incidents

Crates.io incident 2018-10-15

Hello everyone! Earlier today the crates.io team identified a user who was impersonating an official account, and programmatically spamming the registry with empty packages that contained a suggestion to create new issues on the crates.io issue tracker. It was noticed fairly quickly, and actions were taken to stop the publishing of future packages. You may have noticed the tweet from @cratesiostatus: The crates.io team will be providing a full report on this later on blog.rust-lang.org. Than…