To me the problem solved by namespaces is making it clear what's an official package of a project and what's a non-malicious third party package intended to work with that project.
e.g. bevy and amethyst have claimed a load of crate names like bevy-x or amethyst_y because they thought they might release an official addon to their framework to handle those areas. e.g. bevy did it with this https://github.com/bevyengine/bevy-crate-reservations/blob/m... and amethyst did it the long way as far as I know
Organisations wanting to have consistent package names and users wanting to identify related packages are smaller problems than the "all the good names are taken" and "packages can impersonate other packages with typos" problems.
I'm not sure I necessarily agree with that... But yeah I specifically did not want to get into what namespaces do solve, and so was instead vague and just acknowledged that they're good for something. :-)
I will also say this: at the level of personal preference, and given my understanding of many other package ecosystems, I would have preferred namespaces from the start. But I don't feel very strongly one way or the other to be honest.
> "packages can impersonate other packages with typos" problems
I was pointing out that this is specifically not solved at all by namespacing. A package's name includes its namespace, and the namespace can be typo-squatted. (EDIT: Or wait, maybe I'm misunderstanding what you're saying. Perhaps I'm confused by what "these" refers to in your last sentence.)
Popular crates could be "symlinked" into a global verified namespace, problem solved? I can't see any downsides other than some extra administration perhaps.
Yes, you buried all of the very difficult parts of your suggestion in "extra administration." Who decides what's popular? Who decides when it isn't popular any more? Who decides who gets which name in the global namespace?
I think I'm just going to refrain from talking about namespaces now. I tried to be super vague and just point out one thing that wasn't solved by namespaces (typo-squatting), but I've somehow gotten sucked into this discussion.
No more. I'm done. Sorry, it isn't directed at you. Just tired of the discussion around namespaces and the neglect to account for the "admin" parts of it.
For malicious intents, yes. But, for legitimate reasons where you need to have an "rg" package with a completely different use case, owner namespaced packages might provide a uniform solution.
Namespaces are a solution or mitigation to some problem, but that problem is not malicious typo-squatting.