3 ms·

I think "unpublishing" packages is generally not something that should be done, except in the case of malware and maybe some other cases, and I believe that e.g

I think "unpublishing" packages is generally not something that should be done, except in the case of malware and maybe some other cases, and I believe that e.g. NPM already went through an iteration of this issue, which is why they have an explicit policy around it: https://docs.npmjs.com/policies/unpublish https://docs.npmjs.com/policies/unpublish But I would suggest to developers that if their contribution becomes "critical" and they don't want to bear that burden anymore, they should lose the rights to make any further updates, which is, I believe, also the line that PyPI itself takes. The fact that a package got yanked from the registry because of this is an unfortunate combination of a) PyPI allowing it (they shouldn't, and learn from NPM's mistakes), and b) the maintainer being really unreasonable in the face of a perfectly reasonable request.

Brian_K_White 4y ago
There is no reason the index can't do the extra thing they want for their own reasons themselves. There is no valid reason to demand the already-a-volunteer do anything extra to supply something they want for their own reasons. They could collect the source and vet the updates all kinds of other ways than demanding the author jump through hoops for them, for free.
- staticassertion 4y ago
  > They could collect the source and vet the updates all kinds of other ways than demanding the author jump through hoops for them, for free. At minimum it's completely unproven that that would be practical, whereas 2FA is trivial and has been widely deployed for decades. But if you feel strongly about this feel free to make a formal proposal. There are some nascent projects exploring this area that you could draw inspiration from and I'd certainly welcome tooling in that area.
  - Brian_K_White 4y ago
    What a weird leap. Now not only the author of some software has to jump through someone else's hoops, I a total bystander also has to? It does not require "feel strongly" to observe the invalidity of some argument. Rather, if you feel so strongly that something should be done, like vet that software, you could do it.
    - staticassertion 4y ago
      You don't have to do anything?
the_mitsuhiko 4y ago
> But I would suggest to developers that if their contribution becomes "critical" and they don't want to bear that burden anymore, they should lose the rights to make any further updates, which is, I believe, also the line that PyPI itself takes. That seems worse to me for quite a few cases that go towards actual burden beyond 2FA. That implies the index will take away someone's permission over their creation as a result of too many other people also started using it. There is a reason why I have a "No Warrenty" clause in the licenses of my Open Source work. I have created it for others to enjoy it, but I reserve the rights to not be burdened by my users for the unpaid labor.
- giaour 4y ago
  > That implies the index will take away someone's permission over their creation as a result of too many other people also started using it. The creation here is the package, not the distribution channel. You can use an alternative Pypi-compatible index (there's one built into Github, and enterprisey ones can be purchased from Azure or AWS) or you can put instructions for a local build & install on your blog. The maintainers of PyPI should be able to enforce some amount of quality control over their creation, after all.
- Tainnor 4y ago
  No, they simply take away your rights to publish your creation to their index. You can always publish your creation on your website or wherever.
  - jka 4y ago
    > You can always publish your creation on your website or wherever. What you're suggesting wouldn't solve the problem for critical packages, though; the effect would be similar to yesterday's package unpublish issue[1] (all users of the package would have to update their dependency references despite no change in the content of the code). [1] - https://news.ycombinator.com/item?id=32026624 https://news.ycombinator.com/item?id=32026624
    - staticassertion 4y ago

Brian_K_White 4y ago

There is no reason the index can't do the extra thing they want for their own reasons themselves. There is no valid reason to demand the already-a-volunteer do anything extra to supply something they want for their own reasons. They could collect the source and vet the updates all kinds of other ways than demanding the author jump through hoops for them, for free.

staticassertion 4y ago
> They could collect the source and vet the updates all kinds of other ways than demanding the author jump through hoops for them, for free. At minimum it's completely unproven that that would be practical, whereas 2FA is trivial and has been widely deployed for decades. But if you feel strongly about this feel free to make a formal proposal. There are some nascent projects exploring this area that you could draw inspiration from and I'd certainly welcome tooling in that area.
- Brian_K_White 4y ago
  What a weird leap. Now not only the author of some software has to jump through someone else's hoops, I a total bystander also has to? It does not require "feel strongly" to observe the invalidity of some argument. Rather, if you feel so strongly that something should be done, like vet that software, you could do it.
  - staticassertion 4y ago
    You don't have to do anything?

the_mitsuhiko 4y ago

> But I would suggest to developers that if their contribution becomes "critical" and they don't want to bear that burden anymore, they should lose the rights to make any further updates, which is, I believe, also the line that PyPI itself takes. That seems worse to me for quite a few cases that go towards actual burden beyond 2FA. That implies the index will take away someone's permission over their creation as a result of too many other people also started using it. There is a reason why I have a "No Warrenty" clause in the licenses of my Open Source work. I have created it for others to enjoy it, but I reserve the rights to not be burdened by my users for the unpaid labor.

giaour 4y ago
> That implies the index will take away someone's permission over their creation as a result of too many other people also started using it. The creation here is the package, not the distribution channel. You can use an alternative Pypi-compatible index (there's one built into Github, and enterprisey ones can be purchased from Azure or AWS) or you can put instructions for a local build & install on your blog. The maintainers of PyPI should be able to enforce some amount of quality control over their creation, after all.
Tainnor 4y ago
No, they simply take away your rights to publish your creation to their index. You can always publish your creation on your website or wherever.
- jka 4y ago
  > You can always publish your creation on your website or wherever. What you're suggesting wouldn't solve the problem for critical packages, though; the effect would be similar to yesterday's package unpublish issue[1] (all users of the package would have to update their dependency references despite no change in the content of the code). [1] - https://news.ycombinator.com/item?id=32026624 https://news.ycombinator.com/item?id=32026624
  - staticassertion 4y ago