Scoped packages to triage package squatting

[kpreid]

@mcandre

Last I checked, crates.io was littered with hundreds of useless parking packages, similar to how domain names encourage squatters.

The crates.io team is currently deleting such packages as they are discovered. If you find some not yet deleted, you can report them to help@crates.io, as mentioned in the policy.

@mcandre

We can help developers publish packages more easily, by phasing out the existing package names in favor of scoped names, similar to what NPM offers. As a bonus, scoped names help to protect against fraudulent packages. Attacking a system shouldn't be as easy as slapping a "-v2" prefix on top of an existing package name.

This has been proposed many times. Please review the prior discussions to understand why it hasn’t already been done, and what a new argument for it would need to address.

• https://github.com/rust-lang/rfcs/pull/2978
• Pre-RFC: User namespaces on crates.io
• Pre-RFC: (hyper)minimalist namespaces on crates.io
• Namespacing on Crates.io
• Scoped packages (like in npm)?

There is, however, an accepted RFC (which could use some help with implementation work) that will improve the situation in this space: RFC 3243, Packages as namespaces. This will take the pressure off of projectname-packagename pseudo-namespacing by allowing the owners of a particular package to publish further packages which are in the namespace of that package, and thus unambiguously approved by that same owner.