4 ms·
I don't understand why this is up for debate. The Atomicwrites maintainer/author has been using PyPIs servers and infrastructure to host and serve his project
by olliej 4y ago
I don't understand why this is up for debate.
The Atomicwrites maintainer/author has been using PyPIs servers and infrastructure to host and serve his project for free.
PyPI have no responsibility to do that, and that maintainer has always been free to publish his project himself. Instead the Atomicwrites maintainer doesn't want to do that, what they want is to be able to exploit someone else's infrastructure, and they want free rein on that infrastructure despite, again not paying a cent for that infrastructure. There is a weird belief that PyPI is the side of this equation that is exploiting the maintainer - by requiring literally the bare minimum of modern security - and not the Atomicwrites author exploiting the PyPI infrastructure to host their project.
Anyone arguing that PyPI is not allowed to make any demands of someone using their infrastructure, for free, because that is somehow unreasonable, is delusional. It's no different than having your own project, and someone push a PR, and you being required to take the change - after all they gave it to you for free.
- ivraatiems 4y ago> Anyone arguing that PyPI is not allowed to make any demands of someone using their infrastructure, for free, because that is somehow unreasonable, is delusional. It's no different than having your own project, and someone push a PR, and you being required to take the change - after all they gave it to you for free. He's not arguing they're not allowed. He admits they are allowed, but he doesn't want them to do it. He thinks it's a bad idea. I don't agree with him, but I think you are misrepresenting his views here.
- olliej 4y agoThe atomic writes maintainer was free to simply stop using their hosting service, but what he did was try to continue to use their hosting service without doing the bare minimum to protect that service. So I don't believe I am misrepresenting them, nor the people who have defended their actions. They have made it _very_ clear that they believe PyPI should be forced to host every project whether they want to follow the rules or not.
- the_mitsuhiko 4y ago> He was free to simply stop using their hosting service, but what he did was try to continue to use their hosting service without doing the bare minimum to protect that service. Who is "he"?
- olliej 4y agothe maintainer of atomicwrites, the person that started this whole saga, I guess that I had assumed context was sufficient here. I've updated the original text.
- the_mitsuhiko 4y agoYou're misrepresenting the maintainer. He is using 2FA.
- olliej 4y agoNo I haven't. This maintainer got told that he needed to use 2FA for PyPI, instead of doing that most basic of actions he had a tantrum and removed his project: https://news.ycombinator.com/item?id=32026624 https://news.ycombinator.com/item?id=32026624 So that he could continue to use PyPI's infrastructure to publish his work for free.
- the_mitsuhiko 4y agoI happen to work with that person so I had the enjoyment to watch this unfold as it happened. The maintainer thought the package would remain after deletion for existing users as it does for instance on crates.io. I also know that he uses 2FA.