5 ms·

>but his response feels more so If we keep treating open source maintainers like they owe us anything, we will have fewer open source maintainers.

by krasin 4y ago

djhaskin987 4y ago
That's fair, he owes us nothing[1]; I agree with that. But it's not unreasonable to protect the larger community with basic security practices, either. 1: https://gist.github.com/richhickey/1563cddea1002958f96e7ba9519972d9 https://gist.github.com/richhickey/1563cddea1002958f96e7ba95...
- krasin 4y ago
  I am not objecting the 2FA deployment - it's a good idea. I am objecting the attitude towards maintainers which disagree - they have the right to disagree. They owe us nothing.
yongjik 4y ago
We can say the same thing about maintainers of PyPI. They host your libraries and serve it to anyone who wants, free of charge. The only thing they ask in return is to maintain a minimum level of security so that they have less headache in the future. I think they also deserve some respect.
- krasin 4y ago
  Yep. Both parties here are within their rights. It's the HN comment about entitlement of the maintainer that I was responding to.
  - Wowfunhappy 4y ago
    I think both parties are within their rights, but I also think this is a stupid move on PyPI's part. Maintainers are already working for free; start making them jump through hoops and some will decide it's all too much work and leave. I think it would be much better to throw up a warning (potentially a loud one) when a dependency is maintained by someone without 2FA.
    - tsimionescu 4y ago
      Packages being taken over because of stolen credentials creates a maintenance nightmare, and bad publicity, for PyPI itself. As such, they have every right, and a reasonable need, to require 2FA. In contrast, the maintainers of PyPI don't lose too much if a few projects choose not to use the platform anymore. Remember, you're not paying PyPI anything either, so the fact that it may inconvenience your own projects, whether free or proprietary, is not their problem.
staticassertion 4y ago
> we will have fewer open source maintainers. That isn't necessarily a bad thing. I would be happy to lose every developer who is unwilling to enable 2FA. I am glad to see that that's what happened here. The developer has no responsibility to maintain their code, and PyPI has no responsibility to let them publish their code. Both sides discussed this and an agreement was reached - the developer will no longer publish their code to PyPI. No one acted maliciously. Everyone wins.

>but his response feels more so If we keep treating open source maintainers like they owe us anything, we will have fewer open source maintainers.

by krasin 4y ago

>but his response feels more so If we keep treating open source maintainers like they owe us anything, we will have fewer open source maintainers.

djhaskin987 4y ago

That's fair, he owes us nothing[1]; I agree with that. But it's not unreasonable to protect the larger community with basic security practices, either. 1: https://gist.github.com/richhickey/1563cddea1002958f96e7ba9519972d9 https://gist.github.com/richhickey/1563cddea1002958f96e7ba95...

krasin 4y ago
I am not objecting the 2FA deployment - it's a good idea. I am objecting the attitude towards maintainers which disagree - they have the right to disagree. They owe us nothing.

yongjik 4y ago

We can say the same thing about maintainers of PyPI. They host your libraries and serve it to anyone who wants, free of charge. The only thing they ask in return is to maintain a minimum level of security so that they have less headache in the future. I think they also deserve some respect.

krasin 4y ago
Yep. Both parties here are within their rights. It's the HN comment about entitlement of the maintainer that I was responding to.
- Wowfunhappy 4y ago
  I think both parties are within their rights, but I also think this is a stupid move on PyPI's part. Maintainers are already working for free; start making them jump through hoops and some will decide it's all too much work and leave. I think it would be much better to throw up a warning (potentially a loud one) when a dependency is maintained by someone without 2FA.
  - tsimionescu 4y ago
    Packages being taken over because of stolen credentials creates a maintenance nightmare, and bad publicity, for PyPI itself. As such, they have every right, and a reasonable need, to require 2FA. In contrast, the maintainers of PyPI don't lose too much if a few projects choose not to use the platform anymore. Remember, you're not paying PyPI anything either, so the fact that it may inconvenience your own projects, whether free or proprietary, is not their problem.

staticassertion 4y ago

> we will have fewer open source maintainers. That isn't necessarily a bad thing. I would be happy to lose every developer who is unwilling to enable 2FA. I am glad to see that that's what happened here. The developer has no responsibility to maintain their code, and PyPI has no responsibility to let them publish their code. Both sides discussed this and an agreement was reached - the developer will no longer publish their code to PyPI. No one acted maliciously. Everyone wins.