3 ms·
I keep seeing this claim that open source maintainers shouldn't be upset about a 3rd party mandating we increase our maintenance burden to follow their new rule
by jph00 4y ago
I keep seeing this claim that open source maintainers shouldn't be upset about a 3rd party mandating we increase our maintenance burden to follow their new rules, because it's all about responsibility.
But I also see people claiming that it's not OK for the UK to require an increased maintenance burden for the same reason: https://news.ycombinator.com/item?id=32055756 https://news.ycombinator.com/item?id=32055756
I think we need to accept that it's not a simple matter of responsibility. It's a question of how much maintenance burden is OK to mandate. The claim that open source maintainers should be fine with this increased burden because "responsibility" is not logically sound.
Also, the idea that there's no problem, because OS maintainers can just remove their package from pypi, totally ignores the point that that would be a really bad outcome for everyone that uses that package. I this that's actually a pretty big problem.
- tsimionescu 4y ago> Also, the idea that there's no problem, because OS maintainers can just remove their package from pypi, totally ignores the point that that would be a really bad outcome for everyone that uses that package. I this that's actually a pretty big problem. Is definitely not as big a problem as someone taking over their account and publishing malware under their name is.
- jph00 4y agoPerhaps -- but not "definitely". It depends on what the frequency of each of those things is. So far IIUC the frequency of critical projects being removed from pypi is 1 (in the space of a few days - although it came back), and account takeover of critical projects for malware publishing is 0 (in the space of many years).
- donaldstufft 4y ago- https://python-security.readthedocs.io/pypi-vuln/index-2022-05-24-ctx-domain-takeover.html https://python-security.readthedocs.io/pypi-vuln/index-2022-... - https://www.mend.io/resources/blog/npm-package-javascript-library-compromised-via-account-takeover/ https://www.mend.io/resources/blog/npm-package-javascript-li...
- jph00 4y agoThanks you - I stand corrected.