PEP 755: Implicit namespace policy for PyPI

[steve.dower]

@brettcannon

@pf_moore

Major cloud providers like Amazon, Google and Microsoft have a common prefix for each feature’s corresponding package

Have they indicated that the current situation is a problem for them? Can representatives participate in this thread to make their case?

Without officially speaking for my employer, there is a desire to lower the risk of someone mistaking some random person’s package as being official.

I’ll speak officially: Brett is right

We would likely want to take full ownership of the azure- namespace, and suggest that third-parties use an -azure suffix instead. The main aim is to automatically protect users from attempted typosquats, though. We’re not so concerned about non-malicious users, but don’t really want to burden the PyPI team with having to evaluate each one.

If the team would prefer to scan and assess all new packages under azure- for malicious intent, rather than simply saying “Microsoft automatically asserts their ‘Azure’ trademark over the whole namespace”, then we would live with that. But it seems like a poor use of volunteer time.

(FTR, we’ve requested a few specific typosquats in this namespace be preemptively blocked, and have actively pursued one case of deliberately hijacking an actual name we intended to use, but have pursued more outside this namespace than within.)

@petersuter

To me it sounds like specifying something like pip install azure-loganalytics by microsoft (or equivalent syntax) and automatically confirm the account would be more useful.

I like this. pip install microsoft::azure-loganalytics or microsoft@azure-loganalytics might be hijacking the syntax from something potentially better, but interpreting it as “package must have this user as owner/maintainer” would likely be better than the whole namespace.

@petersuter

Even that would only move the trust problem from the package to the account. How does one know the microsoft account is actually Microsoft?

We’d publish on our own site (probably Python | Microsoft Developer) that it’s our account.^[1] Additional DNS verification might be neat, but simply acknowledging that it’s our account would likely also be sufficient.

---

1. I’m 99% sure we used to have it there, as a “check out our packages” link, but it clearly didn’t survive one of the many rewrites of that page. ↩︎