@@ -5,7 +5,7 @@ author: The Crates.io Team
5
5
---
6
6
7
7
On Monday, Oct 15, starting at approximately 20:00 UTC, crates.io sustained
8
- an operational incident. You can find the status page report [ here] [ status ] , and our
8
+ an operational incident. You can find the status page report [ here] [ status ] and our
9
9
tweets about it [ here] [ tweets ] .
10
10
11
11
[ status ] : http://status.crates.io/incidents/cymjwvkrtjn3
@@ -14,7 +14,7 @@ tweets about it [here][tweets].
14
14
## Root Cause
15
15
16
16
A user called ` cratesio ` was created on crates.io and proceeded to upload
17
- packages using common, short names. These packages contained nothing beyond a
17
+ packages using common, short names. These packages contained nothing beyond a
18
18
` Cargo.toml ` file and a ` README.md ` instructing users that if they wanted to use
19
19
the name, they should open an issue on the crates.io issue tracker.
20
20
@@ -26,14 +26,14 @@ We decided to take action on this behavior because:
26
26
- The contents of the uploaded packages appeared to be an attempt to impersonate
27
27
the crates.io team (both through the username ` cratesio ` , as well as directing people
28
28
to the crates-io issue tracker in the crates' ` Readme ` files)
29
- - the rate of uploading impacted the stability of the service
29
+ - the rate of uploading impacted the stability of the service
30
30
31
31
## Action Taken
32
32
33
33
The user's IP address was banned immediately. We then backdated the users' packages to remove
34
34
their packages from the homepage. We also redirected the ` cratesio ` user's page to a 404.
35
35
36
- Finally, the ` cratesio ` user, and all crates they uploaded were deleted.
36
+ Finally, the ` cratesio ` user and all crates they uploaded were deleted.
37
37
The user was reported to GitHub, and has since been banned by them.
38
38
39
39
## Timeline of events
@@ -67,18 +67,18 @@ this policy in the coming weeks.
67
67
68
68
While it is impossible to tell a user's intent, many, including the team, have
69
69
speculated that this action was either associated with or directly related to the
70
- recent esclation in community frustration around crates.io policies, in particular,
70
+ recent escalation in community frustration around crates.io policies, in particular,
71
71
the squatting policy.
72
72
73
73
Regardless of whether this incident had this intent, the cratesio team would like
74
74
to reiterate that taking actions such as the one we experienced on Tuesday is not
75
- an appropriate way nor effective way to contribute to dialogue about crates.io policy.
75
+ an appropriate nor effective way to contribute to dialogue about crates.io policy.
76
76
We will be adding a policy making it clear that attempting to disrupt crates.io in order
77
- to make or further a point is not approrpriate and will be considered a malicous attack.
77
+ to make or further a point is not appropriate and will be considered a malicious attack.
78
78
We will be deciding on the exact wording of this policy in the coming weeks.
79
79
80
80
If you feel that a policy is problematic, the correct place to propose a change is by
81
- creating an RFC or messaging the team at help@crates.io .
81
+ creating an RFC or messaging the team at help@crates.io .
82
82
83
83
We also have seen a lot of frustration that the crates.io team is not listening to the concerns
84
84
that are being raised on both official and unofficial Rust forums. We agree that we should
@@ -89,7 +89,7 @@ community.
89
89
## Background
90
90
91
91
There has been a growing amount of discussion in the community around our
92
- squatting policy, and our decision not to have namespacing.
92
+ squatting policy and our decision not to have namespacing.
93
93
94
94
[ The original squatting policy] ( https://internals.rust-lang.org/t/crates-io-package-policies/1041 ) ,
95
95
published in 2014, contains a lot more information about the rationale behind
@@ -124,13 +124,13 @@ thread wanting to re-litigate what has already been discussed at length.
124
124
125
125
## Conclusion
126
126
127
- We wanted to share the details of what happened, and why the crates.io team chose to take action
127
+ We wanted to share the details of what happened and why the crates.io team chose to take action
128
128
as quickly as possible. The policy changes we've described will be discussed
129
129
during the next several team meetings. Nothing is set in stone until the team
130
130
has a chance to discuss them further, but we wanted to share the possible
131
131
changes we're discussing to limit speculation on what future actions we're
132
132
planning on taking.
133
133
134
- As a reminder, if you would like to report an incident regarding cratesio you
134
+ As a reminder, if you would like to report an incident regarding cratesio, you
135
135
can message the team at help@crates.io . You can view the status of the service
136
- at https://crates-io.statuspage.io/ or by following @cratesiostatus on Twitter.
136
+ at https://crates-io.statuspage.io/ and/ or by following @cratesiostatus on Twitter.
0 commit comments