3 ms·
I think we need a system to prevent this instead of the wild-west that PyPi has become. For example: Developer signatures that are checked against a community r
by teilo 9y ago
I think we need a system to prevent this instead of the wild-west that PyPi has become. For example: Developer signatures that are checked against a community rating. If someone does `pip install` pip would look up the developer signature of the package and check a community rating that would verify this is a developer who has offered legit packages in the past. It's not foolproof, but it would go a long way towards solving this.
- zokier 9y agoYou could add the ability for well known members to vet newbie developers, maybe by signing their key. And now you have re-invented web of trust.
- teilo 9y agoI was thinking more than the ratings would handle this, rather than having to sign keys. Ratings by well-respected and vetted members would have more weight.
- wongarsu 9y agoThat sounds easy to defeat. Make some mundane, but legit packages (maybe on of those "$X but without the pointless complexity"-packages), gain trust, once trust is reached start uploading typo-squatting packages. Knowing today's internet, programmers from cheap-labour nations (India & Co.) would soon start offering "trusted PyPi accounts" for sale on hacker forums.
- teilo 9y agoYes, but keys can also be revoked, providing a way to mitigate this.