> the only thing we can trust is that the person who made this release is (according to PyPI) allowed to make releases This is wrong. What we are trusting is

> the only thing we can trust is that the person who made this release is (according to PyPI) allowed to make releases This is wrong. What we are trusting is the package author. In Node.js land, I trust the author of Express, because they have provided an awesome library that I and many others have gotten years of use out of. I used to trust Marak, but after his recent injection of malicious code into two of his popular libraries, I don’t anymore, and I won’t use code from his projects. When I want to install an npm module in a project from an author I’ve never used before, I go read the source of their package so I don’t have to trust them (in many cases this has led me to find a number of bugs, and end up switching to another project). Knowing that the same person who released the previous version of this package also released the next version definitely has value to me. A pinned key, like ssh uses, would have value. Is it perfect? Far from it. Is it better than nothing? For me, absolutely.