I ran into this recently too. wanted to publish a five letter package name, and it got flagged as trying to typosquat a very differently spelled “popular” package. I had already gotten myself attached to the name and so now that project just sits in purgatory.
what’s more frustrating, is that once you know npm does this it encourages name squatting, because even if you search and see that a package name is unused, you have to try publishing anyway to make sure the name is actually publishable.
worst for me, I had the project idea like 5 years ago before they added this rule. if I had started name squatting the package then I almost certainly would’ve been able to publish it and sit on it until I was ready.
I do think you're right that it's especially bad that you can't see whether a name is allowed without attempting to publish it. We had to just keep attempting to publish packages until we found one that was allowed, and because of that, we weren't really committed to any of them. If one of the alternatives had gone through, would we have stuck with it or just left it there to take up space? I dunno, I was pretty frustrated with the whole experience!
This is because, since Levenshtein distance allows a replace edit, you can get from a string like “abaa” to any string starting with “ab”. So once you have all 841 strings starting with every combination of the first two characters, that’s it, you’re done, no more names. That’s 1.2% of the total name space actually available to choose from.
841 / 707281 ~= 0.12%, not 1.2%. Furthermore, actually computing all squatted "neighbours" with 2 replacements and insertions/deletions and then greedily taking the first available name as many times as possible (I tried random too, was less effective) yields a set of 672 words that saturates the full 4-character namespace. That leaves just 0.095% of the available namespace.
Ha, thank you for correcting my very simple math. And thanks for finding a smaller set, I knew there was one, but I wasn't feeling up for writing an algorithm that found it (also this one felt very easy to explain, despite just being an upper bound). I'll fix the percentage in the post!
Yes, I was actually surprised at how close my bound was to yours! Mine is still an upper bound, because I didn't try to do any optimisation, but still I'd expected a larger "improvement".
FWIW I think "estie" is a better name anyway; to me it reads the way you suggest pronouncing it, while "estee" looks like "Estée" and seems like it should be pronounced "ESS-tay".
Well… that's good to know haha, thank you for saying so. I liked estee partly because it felt really easy to type (though I also use a Dvorak keyboard layout so I honestly have no idea if that's even true in Qwerty, maybe it's not). Just nice to only have three keys to use. But estie is still pretty good, also it looks a bit like "bestie" which is cute. I'm slightly annoyed that we couldn't use "hoid" — even though it was a backup name that we thought of after we couldn't use estee, it is pretty fun. I'm glad I tried hoid, though, because it revealed how silly the whole Levenshtein distance thing is!
In this literal case, we were hoping to reduce the amount of typing necessary to use the command line tool. npm essentially has a "full Java" option, and it's scopes, but we already have that, it's just really rough to type out npx @storyteller-platform/estee before every alignment command, etc. Same reason that grep, emacs, vim, cat, etc are short, basically. We do also publish the current CLI as a node SEA that you can install as stalign (or whatever you want, it's just one file), and we'll probably do the same for estie, but most folks still seem to use it via npx!
For the libraries, they're still @storyteller-platform/align, etc, which I think is fine.
npx is a fun little security hole thanks to preinstall/postinstall hooks, so just having it as a dependency that adds an estee command would be a nicer solution. @storyteller-platform/estee in the dependency list, and then any npm task can just invoke estee if and when needed. Nice and clean.
Agreed haha, hence the SEA. Folks don't use this CLI as a dependency in another project, though, it's a standalone application (it's used for running forced alignment on an ebook/audiobook pair, or starting a server that accepts requests to run alignment), so adding a bin entry to the package.json doesn't really help much.
I wouldn't have been able to get bablr under these rules. I picked the name partly as a nod to a key inspiration, and also to make it easier to remember as part of the family
marginalia | 17 hours ago
Just go full isekai light novel title.
unfairly-exiled-from-the-hero-npm-registry-i-did-not-give-up-and-instead-became-a-solo-package-and-s-ranked-the-package.json-leaderboards-in-all-adventurers-guildsubernostrum | 13 hours ago
the-fortunes-and-misfortunes-of-the-famous-storyteller-platform-align-et-cetera-who-was-writ-in-javascript-and-during-a-life-of-continud-variety-for-threescore-releases-besides-its-early-development-was-twelve-releases-a-cli-five-times-a-wrapper-whereof-once-to-its-own-sibling-twelve-releases-a-malware-eight-releases-a-quarantined-package-in-npm-at-last-grew-rich-featured-releasd-honest-and-became-archived-a-penitentmarginalia | 11 hours ago
All this to test if a number is odd or not.
jcelerier | 18 hours ago
spoken as someone who doesn't try to push npm packages drunk at 2AM from termux on their phone
[OP] smoores | 17 hours ago
Ha, well, maybe not drunk, but I have definitely published npm packages at 2AM from Termux
lilac | 17 hours ago
I ran into this recently too. wanted to publish a five letter package name, and it got flagged as trying to typosquat a very differently spelled “popular” package. I had already gotten myself attached to the name and so now that project just sits in purgatory.
what’s more frustrating, is that once you know npm does this it encourages name squatting, because even if you search and see that a package name is unused, you have to try publishing anyway to make sure the name is actually publishable.
worst for me, I had the project idea like 5 years ago before they added this rule. if I had started name squatting the package then I almost certainly would’ve been able to publish it and sit on it until I was ready.
[OP] smoores | 15 hours ago
I do think you're right that it's especially bad that you can't see whether a name is allowed without attempting to publish it. We had to just keep attempting to publish packages until we found one that was allowed, and because of that, we weren't really committed to any of them. If one of the alternatives had gone through, would we have stuck with it or just left it there to take up space? I dunno, I was pretty frustrated with the whole experience!
tomsmeding | 16 hours ago
841 / 707281 ~= 0.12%, not 1.2%. Furthermore, actually computing all squatted "neighbours" with 2 replacements and insertions/deletions and then greedily taking the first available name as many times as possible (I tried random too, was less effective) yields a set of 672 words that saturates the full 4-character namespace. That leaves just 0.095% of the available namespace.
[OP] smoores | 15 hours ago
Ha, thank you for correcting my very simple math. And thanks for finding a smaller set, I knew there was one, but I wasn't feeling up for writing an algorithm that found it (also this one felt very easy to explain, despite just being an upper bound). I'll fix the percentage in the post!
tomsmeding | 11 hours ago
Yes, I was actually surprised at how close my bound was to yours! Mine is still an upper bound, because I didn't try to do any optimisation, but still I'd expected a larger "improvement".
observator | 16 hours ago
FWIW I think "estie" is a better name anyway; to me it reads the way you suggest pronouncing it, while "estee" looks like "Estée" and seems like it should be pronounced "ESS-tay".
mna | 15 hours ago
As a Quebecois "estie" will definitely be easy to remember...
[OP] smoores | 15 hours ago
Well… that's good to know haha, thank you for saying so. I liked estee partly because it felt really easy to type (though I also use a Dvorak keyboard layout so I honestly have no idea if that's even true in Qwerty, maybe it's not). Just nice to only have three keys to use. But estie is still pretty good, also it looks a bit like "bestie" which is cute. I'm slightly annoyed that we couldn't use "hoid" — even though it was a backup name that we thought of after we couldn't use estee, it is pretty fun. I'm glad I tried hoid, though, because it revealed how silly the whole Levenshtein distance thing is!
fly | 15 hours ago
Semi-serious take: Maybe we just shouldn't be using 5 character package names? Why not go full Java with it?
[OP] smoores | 15 hours ago
In this literal case, we were hoping to reduce the amount of typing necessary to use the command line tool. npm essentially has a "full Java" option, and it's scopes, but we already have that, it's just really rough to type out
npx @storyteller-platform/esteebefore every alignment command, etc. Same reason thatgrep,emacs,vim,cat, etc are short, basically. We do also publish the current CLI as a node SEA that you can install asstalign(or whatever you want, it's just one file), and we'll probably do the same for estie, but most folks still seem to use it vianpx!For the libraries, they're still
@storyteller-platform/align, etc, which I think is fine.Pomax | 12 hours ago
npx is a fun little security hole thanks to preinstall/postinstall hooks, so just having it as a dependency that adds an
esteecommand would be a nicer solution.@storyteller-platform/esteein the dependency list, and then any npm task can just invokeesteeif and when needed. Nice and clean.[OP] smoores | 12 hours ago
Agreed haha, hence the SEA. Folks don't use this CLI as a dependency in another project, though, it's a standalone application (it's used for running forced alignment on an ebook/audiobook pair, or starting a server that accepts requests to run alignment), so adding a bin entry to the package.json doesn't really help much.
evert | 9 hours ago
If it's meant for just one project, why publish at all? It could just be bundled.
conartist6 | 14 hours ago
I wouldn't have been able to get bablr under these rules. I picked the name partly as a nod to a key inspiration, and also to make it easier to remember as part of the family