If Github isn't used for source control, why on earth is it the only auth provider?

Why has crates.io given Microsoft the ability to control who can and cannot publish Rust code?

Namespacing is whatever, but IMO the real issue is the disproportionate and unnecessary amount of power given to a company known for pushing monopolies.

While I don't want to deny the problems of not having namespaces, they will introduce a new set of problems. One issue with Github and similar platforms with namespaces is that a search for a repo turns up multiple projects with the same name under different namespaces. It's always a confusion as to which one is canonical. Another problem is that people are now going to name squat namespaces instead of project names. Imagine somebody registers the serde namespace. Their crates may be mistaken as the canonical one.

Apparently there's an effort underway. I don't have any more context than this:

https://news.ycombinator.com/item?id=38020117

I will say that I actually like the flat namespace, but don't have a strong opinion

Eh, they could change #1 if they allow current non-namespaced packages but don't allow new ones. That's a pretty lazy migration strategy, but they could take it a step further and allow aliases (e.g. serde can be namespace/serde, and that's set on the serde package).

But the bigger issue is that the devs don't want to support namespaces.

#2 is the stronger argument imo. A package manager should not rely on a single external source.

I know a lot of people want namespaces. And I think it would be nice for a bigger project to have an obvious way to show which packages are part of this big project, and which are not. For example the different serde serialization formats would not need to be listed in the docs, but simply be present in one single serde-formats namespaces.

It it does fuck all for type squatting. Sure, now I'm safe from getting malicious code by doing tokio/tokiu-http, but tokiu/tokio-http can still be malicious!

The only solution to type squatting would be a checksum. So instead of adding Tokio to your toml file you'd have to add e.g. tokio-fld, with the fld part being some kind of check that is derived from the name. Similar to a hash, all names that are similar to tokio would get a wildly different suffix.

Isn't github used only as the auth provider? It is not using any git features, just leaning on the security guarantees of github. I don't find this too alarming.

If you want, you can use git links when declaring dependencies in Cargo.toml. So alternative to crates.io is basically any git host already!

For #2, there isn't anything stopping a separate auth system not through GitHub. Really just needs someone to own the implementation. See https://github.com/rust-lang/crates.io/issues/326#issuecomment-216662599 for past discussion surrounding this.

@onlinepersona Got this issue two days ago. Someone upload a package with same name of mine. I was need to change the name to also upload.

I don't understand the "serde2" issue. Isn't "someusername/serde" strictly worse than "serde2"?

GitHub being the only auth provider is something the maintainers wanted to fix, but didn't have enough bandwidth to implement. I think they would welcome contributions!

there's https://lib.rs/, never actually used it myself, but it calls itself an alternative to crates.io