4 ms·

I don't see why people should be persuaded at all. PyPi is a software distribution mechanism to millions of PC globally. PyPi is putting their footdown and sayi

I don't see why people should be persuaded at all. PyPi is a software distribution mechanism to millions of PC globally. PyPi is putting their footdown and saying we are going to do everything in power to prevent PyPi from being used as a global malware distribution system. That involves not only securing our software, but ensuring the people who have the capability to do damage are following appropriate security protocol. It's the responsible thing to do. If a package gets compromised its PyPi that has to do cleanup work. It's like complaining that the government forces you to wear your seatbelt.

pyrale 4y ago
> It's the responsible thing to do. Also, conveniently, it's the thing whose cost is not paid by the people deciding to enforce it. > If a package gets compromised its PyPi that has to do cleanup work. Yeah, that's the very essence of being a distribution tool.
- samastur 4y ago
  What costs? You can stuff 2FA token generation in many password managers that run on the very computer on which you develop. It costs you exactly zero except a couple of minutes to set it up.
  - pyrale 4y ago
    > You can stuff 2FA token generation in many password managers that run on the very computer on which you develop. That's one of the reasons I believe 2FA is mostly security theater. That and people insisting they need their shitty app on my unsecured phone. It's not two-factor if all of it is running on the same hardware.
    - nemothekid 4y ago
      >That's one of the reasons I believe 2FA is mostly security theater It's something you know + something you own. That's 2FA.
      - pyrale 4y ago
        Yeah, except that the advent of password managers means that most 2FA users actually rely on something you own + something you own. Everyone can agree that password managers are a good thing. However, it's debatable that, in many setups including the one that was just described, 2FA brings added security.
- Analemma_ 4y ago
  You’re only looking at one side of the cost equation. If a maintainer screws up and lets their account get compromised, and then it uploads malware, it’s PyPI who has to pay the immense cost of cleanup. How is that fair?
  - pyrale 4y ago
    Well, it's PyPi who decides what is critical and what is not. If they're not happy with maintainers not wanting to take that responsibility, they can fork.
- nemothekid 4y ago
  I can do that too: >Yeah, that's the very essence of being a distribution tool. Also, conveniently, it's the thing whose cost is not paid by the people decided to get owned. And again, the government doesn't cover the cost of your seatbelt, so I don't see your argument. PyPi also makes you use passwords, should I complain that they are forcing me to buy a keyboard?
NoGravitas 4y ago
To be quite honest, the most responsible thing for them to do would be to shut down. This goes for other package repositories, as well.

pyrale 4y ago

> It's the responsible thing to do. Also, conveniently, it's the thing whose cost is not paid by the people deciding to enforce it. > If a package gets compromised its PyPi that has to do cleanup work. Yeah, that's the very essence of being a distribution tool.

samastur 4y ago
What costs? You can stuff 2FA token generation in many password managers that run on the very computer on which you develop. It costs you exactly zero except a couple of minutes to set it up.
- pyrale 4y ago
  > You can stuff 2FA token generation in many password managers that run on the very computer on which you develop. That's one of the reasons I believe 2FA is mostly security theater. That and people insisting they need their shitty app on my unsecured phone. It's not two-factor if all of it is running on the same hardware.
  - nemothekid 4y ago
    >That's one of the reasons I believe 2FA is mostly security theater It's something you know + something you own. That's 2FA.
    - pyrale 4y ago
      Yeah, except that the advent of password managers means that most 2FA users actually rely on something you own + something you own. Everyone can agree that password managers are a good thing. However, it's debatable that, in many setups including the one that was just described, 2FA brings added security.
Analemma_ 4y ago
You’re only looking at one side of the cost equation. If a maintainer screws up and lets their account get compromised, and then it uploads malware, it’s PyPI who has to pay the immense cost of cleanup. How is that fair?
- pyrale 4y ago
  Well, it's PyPi who decides what is critical and what is not. If they're not happy with maintainers not wanting to take that responsibility, they can fork.
nemothekid 4y ago
I can do that too: >Yeah, that's the very essence of being a distribution tool. Also, conveniently, it's the thing whose cost is not paid by the people decided to get owned. And again, the government doesn't cover the cost of your seatbelt, so I don't see your argument. PyPi also makes you use passwords, should I complain that they are forcing me to buy a keyboard?

NoGravitas 4y ago

To be quite honest, the most responsible thing for them to do would be to shut down. This goes for other package repositories, as well.