4 ms·
From the article: > The message to me as a maintainer is quite clear: once a project achieved criticality, then the index wants to exercise a certain amount of
by BiteCode_dev 4y ago
From the article:
> The message to me as a maintainer is quite clear: once a project achieved criticality, then the index wants to exercise a certain amount of control
I don't think that's the definition of control. Pypi gains no power with this, only more work.
And 2FA is really not a big deal.
> One could imagine that an index would like to enforce cryptographic signing of newly released packages.
Yes. Please yes.
Letsencrypt was a boon to the web.
Having a quick way to sign your package to send it so pypi would be a great thing.
This is a long article over nothing.
- nibbleshifter 4y ago> Having a quick way to sign your package to send it so pypi would be a great thing. I guess we just need to make signing easy then. Which remains a hard problem.
- dlor 4y agoWe've been working with PyPI to help integrate Sigstore, which makes signing (and verification) easier! sigstore.dev
- nibbleshifter 4y agoI'll have to check out sigstore. Anything that makes signing/verifying easier is a welcome change.
- BiteCode_dev 4y agoWe used to say that about https, and now we got letsencrypt.
- nibbleshifter 4y agoLE made SSL/TLS easy, we need something similar for sign/verify of packages/software. Another commenter mentioned sigstore.dev which looks potentially interesting.
- Tainnor 4y agoWhat, exactly, is hard about signing?
- cowtools 4y ago2FA is a pain in the ass and provides minimal extra security. The reason why companies employ it is because their users are incompetent and will install malware on their desktop OS, so they shift the burden of security to locked-down mobile operating systems like Android and iOS. If an experienced user does not want to use 2FA, they will run the 2FA app in a virtual machine and automate it. You can't force them to 2FA but you can inconvenience them and tie them down to a phone number, SMS, or locked-down hardware (through remote attestation). >Letsencrypt was a boon to the web. Letsencrypt and the existing PKI structure just forces everyone's eggs into a single basket, Ripe for exploitation from the government.
- BiteCode_dev 4y agoWith root certificates, gov already have complete ability to MITM your https connection.
- BiteCode_dev 4y agoIn this particular case, Pypi is giving away hardware security key. I have 3 of them, it is secure and convenient.