# Reduce package registration waiting period
**URL:** https://discourse.julialang.org/t/reduce-package-registration-waiting-period/40954
**Category:** Meta Discussion
**Created:** [June 7, 2020, 9:45pm UTC](https://discourse.julialang.org/t/reduce-package-registration-waiting-period/40954 "2020-06-07T21:45:03Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@anon37204545](https://discourse.julialang.org/u/anon37204545)
#### Post date: [June 7, 2020, 9:45pm UTC](https://discourse.julialang.org/t/reduce-package-registration-waiting-period/40954/1 "2020-06-07T21:45:03Z")
Currently there’s a waiting period of 3 days before a new package is automatically merged into Julia general registry. I feel like the 3 day length was arbitrarily chosen and that it isn’t really required to be that long. Especially for a relatively young ecosystem, as it imperils the package growth.
Also, almost all other package registries have a waiting period of 0 seconds (PyPI and npm for example).
---
### Author:  [@fredrikekre](https://discourse.julialang.org/u/fredrikekre)
#### Post date: [June 7, 2020, 10:18pm UTC](https://discourse.julialang.org/t/reduce-package-registration-waiting-period/40954/2 "2020-06-07T22:18:37Z")
What other arbitrary time would you suggest? Is it really that much to ask to wait 3 days for a package that hopefully will be used for years? When are you ever in a hurry to release a new package?
---
### Author:  [@jonniedie](https://discourse.julialang.org/u/jonniedie)
#### Post date: [June 7, 2020, 10:34pm UTC](https://discourse.julialang.org/t/reduce-package-registration-waiting-period/40954/4 "2020-06-07T22:34:18Z")
I’m not sure I see who this would benefit. The person who is publishing the package already has access to it. Anyone else who can’t wait the three-day registration period can easily add the package by URL.
---
### Author:  [@fredrikekre](https://discourse.julialang.org/u/fredrikekre)
#### Post date: [June 7, 2020, 10:36pm UTC](https://discourse.julialang.org/t/reduce-package-registration-waiting-period/40954/5 "2020-06-07T22:36:44Z")
Waiting seems pretty easy to do, no?
24h seems to short. Given that the idea for the waiting period is for people to chime in I don’t think anything shorter than 3 days is long enough. Can’t expect people (maintainers) to be online 24/7.
---
### Author:  [@mbaz](https://discourse.julialang.org/u/mbaz)
#### Post date: [June 7, 2020, 10:42pm UTC](https://discourse.julialang.org/t/reduce-package-registration-waiting-period/40954/7 "2020-06-07T22:42:20Z")
> [@anon37204545](#):
>
> Currently there’s a waiting period of 3 days before a package is automatically merged into Julia general registry.
Just to clarify, this is for new packages only – new versions of existing packages are merged immediately.
---
### Author:  [@ericphanson](https://discourse.julialang.org/u/ericphanson)
#### Post date: [June 7, 2020, 10:45pm UTC](https://discourse.julialang.org/t/reduce-package-registration-waiting-period/40954/10 "2020-06-07T22:45:51Z")
> [@anon37204545](#):
>
> Remember, npm package registry has more than a million packages. They have no issues with automatic merging into the registry.
I don’t think npm is necessarily a good model to follow though. leftpad etc.
---
### Author:  [@mbaz](https://discourse.julialang.org/u/mbaz)
#### Post date: [June 7, 2020, 10:46pm UTC](https://discourse.julialang.org/t/reduce-package-registration-waiting-period/40954/11 "2020-06-07T22:46:39Z")
> [@anon37204545](#):
>
> I understood that the waiting period was implemented to give authors a chance to block the process,
My understanding is that the main purpose of the wait is to discuss the package name, or other things that might be improved; it definitely involves the maintainers and the (interested) community.
(I’m not advocating for a 3-day wait period, just pointing out what I think might be a misunderstanding).
> [@anon37204545](#):
>
> [npm has] no issues with automatic merging into the registry.
I don’t use npm but, from reading reddit and hacker news, I get the impression that the npm registry policies have caused several significant issues…
---
### Author:  [@jonniedie](https://discourse.julialang.org/u/jonniedie)
#### Post date: [June 7, 2020, 10:49pm UTC](https://discourse.julialang.org/t/reduce-package-registration-waiting-period/40954/12 "2020-06-07T22:49:16Z")
> [@anon37204545](#):
>
> Using the same logic, you can arrive at the conclusion that it is ideal for packages not to be published at all. The person who is publishing the package already has access to it and anyone else who can’t wait the three-day registration period can easily add the package by URL. Am I not right?
No. Registration additionally handles name collisions and, although it doesn’t totally keep malicious code being distributed, allows for some safeguard against obvious attacks.
---
### Author:  [@jonniedie](https://discourse.julialang.org/u/jonniedie)
#### Post date: [June 7, 2020, 11:02pm UTC](https://discourse.julialang.org/t/reduce-package-registration-waiting-period/40954/15 "2020-06-07T23:02:14Z")
> [@anon37204545](#):
>
> What do you mean by name collisions exactly? You cannot register two packages with the same name.
Conflicts is the word I was looking for. You can’t have two registered packages with the same name.
> [@](#):
>
> The best safeguard against malicious open-source software is… seeing who the author is.
But if someone, say here on Discourse, post some cool code that I’d like to try out that has `using SomeCoolPackage` at the top, I’d like to be able to `]add SomeCoolPackage` and run their example without necessarily having to worry about who wrote `SomeCoolPackage`. I know that’s not totally safe, but it’s at least better than nothing.
---
### Author:  [@chakravala](https://discourse.julialang.org/u/chakravala)
#### Post date: [June 7, 2020, 11:08pm UTC](https://discourse.julialang.org/t/reduce-package-registration-waiting-period/40954/16 "2020-06-07T23:08:48Z")
It’s really not a big inconvenience to wait for 3 days to initially register a new package.
The advantage of waiting for 3 days is that it gives the author time to think things over, and makes it so that new registrations are not spontaneous decisions.
Subsequent new releases usually get merged immediately, so that’s not a problem.
---
### Author:  [@Mason](https://discourse.julialang.org/u/Mason)
#### Post date: [June 7, 2020, 11:26pm UTC](https://discourse.julialang.org/t/reduce-package-registration-waiting-period/40954/19 "2020-06-07T23:26:05Z")
I’ll put my name down as well on the side of the status quo.
If you think this is onerous, it’s actually pretty easy to set up your own registry, use that and even encourage others to use it in order to get out from under the oppressive boot of the 3-days in purgatory.
You could probably even make a registry that automatically scans the general registry for packages in purgatory and add them to your registry automatically.
---
### Author:  [@jonniedie](https://discourse.julialang.org/u/jonniedie)
#### Post date: [June 7, 2020, 11:36pm UTC](https://discourse.julialang.org/t/reduce-package-registration-waiting-period/40954/20 "2020-06-07T23:36:28Z")
> [@anon37204545](#):
>
> Waiting period won’t help that, as I described above. You can write a package with thousands of line of code which can obscure the potentially malicious code. And that won’t be noticed in any period of time. How many packages were actually blocked over what you are describing?
The point I was making isn’t that a waiting period is going to solve these problems, it’s that the main purpose of the package registration system isn’t to make packages easier to add or use, it’s to provide users a “this is the official version of the package you are looking for”. That doesn’t really benefit from having a shorter waiting period since three days is pretty short compared to the useful life of a package. There is at least some benefit to an arbitrary, but not too short, waiting period because the most glaring attacks can be caught and it prevents users from too frivolously registering packages. Sorta.
---
### Author:  [@dilumaluthge](https://discourse.julialang.org/u/dilumaluthge)
#### Post date: [June 8, 2020, 1:44am UTC](https://discourse.julialang.org/t/reduce-package-registration-waiting-period/40954/21 "2020-06-08T01:44:48Z")
I am opposed to shortening the waiting period for new packages.
There are plenty of examples in which members of the community have provided feedback on the name, and then the author has chosen to change the name.
Here is a single randomly chosen example: [#15489](https://github.com/JuliaRegistries/General/pull/15489)
The author originally suggested the name `GRPF.jl`. The community provided feedback. One community member suggested the name `RootsAndPoles.jl`. The author and the community engaged in a discussion. The author decided that they liked the name `RootsAndPoles.jl`. The pull request to register the name `GRPF.jl` ([#15489](https://github.com/JuliaRegistries/General/pull/15489)) was closed. The package was registered with the name `RootsAndPoles.jl` ([#15662](https://github.com/JuliaRegistries/General/pull/15662)).
If you go through the history of pull requests on the General registry, you will find other examples.
* * *
Keep in mind that the three-day waiting period only applies to new packages. New versions of existing packages are merged very quickly (within 20-60 minutes).
---
### Author:  [@anon94023334](https://discourse.julialang.org/u/anon94023334)
#### Post date: [June 8, 2020, 3:04am UTC](https://discourse.julialang.org/t/reduce-package-registration-waiting-period/40954/22 "2020-06-08T03:04:55Z")
If anything, I think a current exploration of what’s in the “new” queue would argue for _increasing_ the review time. I count a dozen new projects in the PR list that are 1) simple one-function packages, 2) without documentation, READMEs, or tests, 3) less than 100 or so lines of code, and/or 4) things that probably should be PRs to existing packages. (I realize the last one is subjective.)
I don’t know that it’s reasonable to require the maintainers to review these things for general registry merge within 72 hours, especially when there are other avenues for publication.
---
### Author:  [@rfourquet](https://discourse.julialang.org/u/rfourquet)
#### Post date: [June 8, 2020, 6:32am UTC](https://discourse.julialang.org/t/reduce-package-registration-waiting-period/40954/23 "2020-06-08T06:32:26Z")
> [@anon37204545](#):
>
> This is my key argument for reducing the waiting time:
>
> > Also, almost all other package registries have a waiting period of 0 seconds (PyPI and npm for example)
I don’t know much about other package registries, but this really doesn’t sound like a convincing argument, unless it’s demonstrated that the consequences of this policy were beneficial.
A counter argument to a zero-seconds waiting period: this wouldn’t give a lot of times to prevent an “attacker” from stealing a bunch of package names from the shared namespace. Of course there could be measures against that, but a three day waiting period is a natural such measure and has other advantages as pointed out by others.
---
### Author:  [@Tamas\_Papp](https://discourse.julialang.org/u/Tamas_Papp)
#### Post date: [June 8, 2020, 6:46am UTC](https://discourse.julialang.org/t/reduce-package-registration-waiting-period/40954/24 "2020-06-08T06:46:06Z")
> [@anon37204545](#):
>
> Especially for a relatively young ecosystem, as it imperils the package growth.
I am not sure what you mean by this. Waiting three days is insignificant compared to the lifecycle of a successful package. If anything, the waiting period should be _increased_, to eg a week — not everyone is online 24/7.
Also, you may not be aware that Julia’s package manager has facilities for [third-party registries](https://julialang.github.io/Pkg.jl/dev/registries/). People who are effectively constrained by the 3-day waiting period for their own set of interdependent packages should probably just start their own [local registry](https://github.com/GunnarFarneback/LocalRegistry.jl).
---
### Author:  [@yakir12](https://discourse.julialang.org/u/yakir12)
#### Post date: [June 8, 2020, 7:06am UTC](https://discourse.julialang.org/t/reduce-package-registration-waiting-period/40954/25 "2020-06-08T07:06:42Z")
I’m one of “those” people: I was setting up tools for my lab, needed to have packages depend on each other, was publishing some of the basic ones, requested to register yet another package in my toolkit, and within the 3 day waiting time I managed to get useful feedback about some technical problems I was having (that package included a dependency on Matlab), was made aware of LocalRegistry.jl, retracted my registration (I think after like 40 hours), and now I and my lab use LocalRegistry all the time. It’s fantastic.
---
### Author:  [@fredrikekre](https://discourse.julialang.org/u/fredrikekre)
#### Post date: [June 8, 2020, 7:13am UTC](https://discourse.julialang.org/t/reduce-package-registration-waiting-period/40954/26 "2020-06-08T07:13:52Z")
> [@anon37204545](#):
>
> Ideally, packages that can be merged automatically should require no maintainer input at all.
But how do you determine what is automatically mergeable without human intervention?
> [@anon37204545](#):
>
> I understood that the waiting period was implemented to give authors a chance to block the process, in case they think something is wrong. There is nothing related to maintainers.
No, it is for other people to have input, not the maintainer. However, it is quite often that the maintainer realizes there is a mistake and is happy about the waiting period too.
---
### Author:  [@Tamas\_Papp](https://discourse.julialang.org/u/Tamas_Papp)
#### Post date: [June 8, 2020, 12:35pm UTC](https://discourse.julialang.org/t/reduce-package-registration-waiting-period/40954/27 "2020-06-08T12:35:42Z")
> [@anon37204545](#):
>
> it does seem long for packages that can be built in a day or two, or even in just a few hours
I am wondering if the reason for this whole discussions is the two packages you [submitted for registration recently](https://discourse.julialang.org/t/transliterate-jl-isurl-jl-useful-tools/40951), with \<50 lines of runtime code each (one has data as code in addition).
As some people point out in the discussion, in the Julia ecosystem packages it is common for packages to be a bit more complex, . This is exactly the kind of feedback that can happen during the 3-day waiting period. Of course, these are just customs, and you are free to ignore them and register your packages as is.
---
### Author:  [@pixel27](https://discourse.julialang.org/u/pixel27)
#### Post date: [June 8, 2020, 1:01pm UTC](https://discourse.julialang.org/t/reduce-package-registration-waiting-period/40954/28 "2020-06-08T13:01:25Z")
I guess my argument for the 3 day waiting period would be someone creating a script to flood the package registration, and run it over the weekend when not many people are looking. With the 3 day waiting period there should be time to catch what’s happening pause the whole process and deal with it. Which would probably be easier than retroactively trying to go back and prune out the offending packages.
I’ve only published a single package and the 3 day waiting period while kind of stressful (would my package be accepted, would I be asked to change something) didn’t really block me from doing what I needed to do.
[Next page](https://discourse.julialang.org/t/reduce-package-registration-waiting-period/40954.md?page=2)