4 ms·

However, just as open source developers don't owe downstream, package repositories don't owe open source developers. The package repository isn't preventing the

by __s 4y ago

However, just as open source developers don't owe downstream, package repositories don't owe open source developers. The package repository isn't preventing the developers from continuing to publish their packages elsewhere If I'm an open source developer who starts uploading malicious packages to a repository they aren't obliged to not delist my malicious packages. PyPI is proactively considering critical packages without 2FA protection malicious

cowtools 4y ago
>PyPI is proactively considering critical packages without 2FA protection malicious And it's ridiculous for them to do so. How can they verify that the 2FA program is not just being run in a virtual machine? At the end of the day it's the maintainer that decides the security of the package.
- striking 4y ago
  You appear to have a fundamental misunderstanding of the 2FA in this case. TOTP-based 2FA is available for PyPI, for which any number of FOSS freely-runnable clients are available. See also https://pypi.org/help/#totp https://pypi.org/help/#totp
  - josephcsible 4y ago
    I think GP is actually saying that there's no way to prove that users aren't storing their TOTP secrets in a way that defeats the purpose of 2FA, such as right next to their passwords in cleartext.
    - woodruffw 4y ago
      This is why we encourage WebAuthn by default (and why PyPI is giving out free security keys): it’s much more misuse-resistant. Ultimately, PyPI cannot prevent TOTP secret misuse. But we expect the overwhelming majority of users to not misuse TOTP, and a corresponding security advantage therefrom.
the_mitsuhiko 4y ago
Author here. > The package repository isn't preventing the developers from continuing to publish their packages elsewhere You are right that the package index doesn't owe developers anything and this is in fact something I called out explicitly in the post. However I believe your point about "isn't preventing" is not quite accurate. In order to participate in dependency trees in most ecosystems you need to be on "the" index. Yes, you can sort of create dependencies to stuff off PyPI but this breaks down really quickly. Because of this PyPI has a special role to play. This is not too dissimilar to discussions we are having about freedom of speech and similar things at the moment and I think the answers are much more nuanced and complex than it might look on the surface. If PyPI were to start putting restrictions on some people publishing or accessing packages, we had a much bigger challenge on our hand. To be clear: this discussion is not about that, but the "just move somewhere else" type of answer I do not believe is a good option to dissatisfaction with the primary index.
- jayofdoom 4y ago
  I suspect your discounting the amount of effort it takes pypi index maintainers to respond to compromised packages. In the same way folks can get upset over being required to use 2fa, the package index maintainers likely get upset every time that they lose hours of their life due to someone not using 2fa. Despite much of this being critical infrastructure, I would be surprised if most people who run the index are doing so as part of their day job instead of volunteering. This is why I always try to show a lot of grace when people make decisions that I don't understand, because they may be facing situations I don't understand.
- __s 4y ago
  Overall I agree that the matter is more nuanced than my original comment would indicate re requiring 2FA across the platform, I wouldn't be surprised if 2FA requirements eventually expand to everyone Maybe this could've been opt-in by having a way for projects to require their dependencies be 2FA all the way down. Since the current policy has a bit of a hole: if you're a critical package, are you allowed to depend on a non-critical package? Are you no longer able to add non-critical dependencies?

by __s 4y ago

cowtools 4y ago

>PyPI is proactively considering critical packages without 2FA protection malicious And it's ridiculous for them to do so. How can they verify that the 2FA program is not just being run in a virtual machine? At the end of the day it's the maintainer that decides the security of the package.

striking 4y ago
You appear to have a fundamental misunderstanding of the 2FA in this case. TOTP-based 2FA is available for PyPI, for which any number of FOSS freely-runnable clients are available. See also https://pypi.org/help/#totp https://pypi.org/help/#totp
- josephcsible 4y ago
  I think GP is actually saying that there's no way to prove that users aren't storing their TOTP secrets in a way that defeats the purpose of 2FA, such as right next to their passwords in cleartext.
  - woodruffw 4y ago
    This is why we encourage WebAuthn by default (and why PyPI is giving out free security keys): it’s much more misuse-resistant. Ultimately, PyPI cannot prevent TOTP secret misuse. But we expect the overwhelming majority of users to not misuse TOTP, and a corresponding security advantage therefrom.

the_mitsuhiko 4y ago

Author here. > The package repository isn't preventing the developers from continuing to publish their packages elsewhere You are right that the package index doesn't owe developers anything and this is in fact something I called out explicitly in the post. However I believe your point about "isn't preventing" is not quite accurate. In order to participate in dependency trees in most ecosystems you need to be on "the" index. Yes, you can sort of create dependencies to stuff off PyPI but this breaks down really quickly. Because of this PyPI has a special role to play. This is not too dissimilar to discussions we are having about freedom of speech and similar things at the moment and I think the answers are much more nuanced and complex than it might look on the surface. If PyPI were to start putting restrictions on some people publishing or accessing packages, we had a much bigger challenge on our hand. To be clear: this discussion is not about that, but the "just move somewhere else" type of answer I do not believe is a good option to dissatisfaction with the primary index.

jayofdoom 4y ago
I suspect your discounting the amount of effort it takes pypi index maintainers to respond to compromised packages. In the same way folks can get upset over being required to use 2fa, the package index maintainers likely get upset every time that they lose hours of their life due to someone not using 2fa. Despite much of this being critical infrastructure, I would be surprised if most people who run the index are doing so as part of their day job instead of volunteering. This is why I always try to show a lot of grace when people make decisions that I don't understand, because they may be facing situations I don't understand.
__s 4y ago
Overall I agree that the matter is more nuanced than my original comment would indicate re requiring 2FA across the platform, I wouldn't be surprised if 2FA requirements eventually expand to everyone Maybe this could've been opt-in by having a way for projects to require their dependencies be 2FA all the way down. Since the current policy has a bit of a hole: if you're a critical package, are you allowed to depend on a non-critical package? Are you no longer able to add non-critical dependencies?