3 ms·

That blog post provides nothing of value. It complains that there isn´t package signing and that´s it. It doesn´t propose anything. In the comments the author

That blog post provides nothing of value. It complains that there isn´t package signing and that´s it. It doesn´t propose anything. In the comments the author claims removing the signing is "beyond logic" even while linking to a reddit thread in which the logic is laid out clearly. For example: https://caremad.io/posts/2013/07/packaging-signing-not-holy-grail/ https://caremad.io/posts/2013/07/packaging-signing-not-holy-... https://mail.python.org/pipermail/distutils-sig/2018-March/032066.html https://mail.python.org/pipermail/distutils-sig/2018-March/0... https://old.reddit.com/r/Python/comments/8r9qby/pypi_has_removed_pgp_signatures_of_package/ https://old.reddit.com/r/Python/comments/8r9qby/pypi_has_rem... Read those links if you are curious, but I would recommend skipping the post linked by el_programmador. Read

new_realist 7y ago
Your comment provides nothing of value. It complains that the blog post contains nothing of value and that’s it. It doesn’t propose anything. I would propose abandoning PIP in favor of signed packages from your favorite secure Linux distribution.
- CogitoCogito 7y ago
  My post points out the useful links and information found in the comments of that post. It contains _everything_ valuable behind that post. The game you’re playing trying to turn this around me is childish and pointless.