9 ms·
If they slip further down the slope you can, as a maintainer, protest there. 2FA is literally the least you can do to help prevent the kind of 'supply chain att
by sleepybrett 4y ago
If they slip further down the slope you can, as a maintainer, protest there. 2FA is literally the least you can do to help prevent the kind of 'supply chain attacks' we've been seeing in the open source community for years now. If they continue, in spite of your protest, you can always distribute your library some other way or retire it.
- pyrale 4y agoThe author of the article this thread is about is litterally pushing further down that particular slope: > And if your package gets established and has people regularly using it, you have some responsibility not to mess with those users. If you want to make backwards-incompatible changes, for example, communicate them and bump the major version number. If you want to stop maintaining the package, post an announcement about it and be willing to hand over to someone else to continue work.
- donaldstufft 4y agoNot really, none of those things are things he is suggesting PyPI should do, but rather social expectations that come from being a maintainer of a large project.
- nomdep 4y agoSure, but they have the same implicit “… or else”, meaning losing the capacity to publish again on PyPI until they “fix their attitude”