3 ms·

Why is there no indication of any of this on the python.org website or any of their social media accounts? I checked: https://pypi.python.org/pypi https://pyp

Why is there no indication of any of this on the python.org website or any of their social media accounts? I checked: https://pypi.python.org/pypi https://pypi.python.org/pypi https://www.python.org/blogs/ https://www.python.org/blogs/ http://planetpython.org/ http://planetpython.org/ https://pypi.python.org/security https://pypi.python.org/security https://twitter.com/pythoninsider https://twitter.com/pythoninsider https://plus.google.com/+Python https://plus.google.com/+Python https://www.facebook.com/pythonlang?fref=ts https://www.facebook.com/pythonlang?fref=ts https://twitter.com/ThePSF https://twitter.com/ThePSF

takluyver 9y ago
I guess that's because it's not a surprise. This has come up before, and it's basically unavoidable with the way PyPI is designed to work: if you see an unclaimed name, you can put whatever you want there.
- geekamongus 9y ago
  I see your point, but I don't think that it needs to be a surprise to be announced or made well-known. No one is surprised that Microsoft releases loads of patches every Patch Tuesday, but they still publicize it and make it well known and easy for people to find out about.
haypo 9y ago
While there is no public announcement from the PSF yet, I sent an email to the python-dev mailing list at least to announce the issue but also try to discuss how to mitigate/prevent it. https://mail.python.org/pipermail/python-dev/2017-September/149569.html https://mail.python.org/pipermail/python-dev/2017-September/... Honestly, I am impressed that the information gone so quick! The National Security Authority of Slovakia contacted the PSRT 10 days ago. All packages were removed 1h10 after we got their email. We were discussing how to communicate about this issue, while they published an advisory. A few hours after the advisory was published, I saw the information on IRC, Twitter, LWN, etc. I didn't expect that the advisory would be published so quickly. FYI last week there was also a CPython sprint attended by more than 20 Python core developers. We were busy on discussing Python enhancements.

takluyver 9y ago

I guess that's because it's not a surprise. This has come up before, and it's basically unavoidable with the way PyPI is designed to work: if you see an unclaimed name, you can put whatever you want there.

geekamongus 9y ago
I see your point, but I don't think that it needs to be a surprise to be announced or made well-known. No one is surprised that Microsoft releases loads of patches every Patch Tuesday, but they still publicize it and make it well known and easy for people to find out about.

haypo 9y ago

While there is no public announcement from the PSF yet, I sent an email to the python-dev mailing list at least to announce the issue but also try to discuss how to mitigate/prevent it. https://mail.python.org/pipermail/python-dev/2017-September/149569.html https://mail.python.org/pipermail/python-dev/2017-September/... Honestly, I am impressed that the information gone so quick! The National Security Authority of Slovakia contacted the PSRT 10 days ago. All packages were removed 1h10 after we got their email. We were discussing how to communicate about this issue, while they published an advisory. A few hours after the advisory was published, I saw the information on IRC, Twitter, LWN, etc. I didn't expect that the advisory would be published so quickly. FYI last week there was also a CPython sprint attended by more than 20 Python core developers. We were busy on discussing Python enhancements.