3 ms·

Author here. > The package repository isn't preventing the developers from continuing to publish their packages elsewhere You are right that the package index

Author here. > The package repository isn't preventing the developers from continuing to publish their packages elsewhere You are right that the package index doesn't owe developers anything and this is in fact something I called out explicitly in the post. However I believe your point about "isn't preventing" is not quite accurate. In order to participate in dependency trees in most ecosystems you need to be on "the" index. Yes, you can sort of create dependencies to stuff off PyPI but this breaks down really quickly. Because of this PyPI has a special role to play. This is not too dissimilar to discussions we are having about freedom of speech and similar things at the moment and I think the answers are much more nuanced and complex than it might look on the surface. If PyPI were to start putting restrictions on some people publishing or accessing packages, we had a much bigger challenge on our hand. To be clear: this discussion is not about that, but the "just move somewhere else" type of answer I do not believe is a good option to dissatisfaction with the primary index.

jayofdoom 4y ago
I suspect your discounting the amount of effort it takes pypi index maintainers to respond to compromised packages. In the same way folks can get upset over being required to use 2fa, the package index maintainers likely get upset every time that they lose hours of their life due to someone not using 2fa. Despite much of this being critical infrastructure, I would be surprised if most people who run the index are doing so as part of their day job instead of volunteering. This is why I always try to show a lot of grace when people make decisions that I don't understand, because they may be facing situations I don't understand.
__s 4y ago
Overall I agree that the matter is more nuanced than my original comment would indicate re requiring 2FA across the platform, I wouldn't be surprised if 2FA requirements eventually expand to everyone Maybe this could've been opt-in by having a way for projects to require their dependencies be 2FA all the way down. Since the current policy has a bit of a hole: if you're a critical package, are you allowed to depend on a non-critical package? Are you no longer able to add non-critical dependencies?

jayofdoom 4y ago

I suspect your discounting the amount of effort it takes pypi index maintainers to respond to compromised packages. In the same way folks can get upset over being required to use 2fa, the package index maintainers likely get upset every time that they lose hours of their life due to someone not using 2fa. Despite much of this being critical infrastructure, I would be surprised if most people who run the index are doing so as part of their day job instead of volunteering. This is why I always try to show a lot of grace when people make decisions that I don't understand, because they may be facing situations I don't understand.

__s 4y ago

Overall I agree that the matter is more nuanced than my original comment would indicate re requiring 2FA across the platform, I wouldn't be surprised if 2FA requirements eventually expand to everyone Maybe this could've been opt-in by having a way for projects to require their dependencies be 2FA all the way down. Since the current policy has a bit of a hole: if you're a critical package, are you allowed to depend on a non-critical package? Are you no longer able to add non-critical dependencies?