3 ms·
pypi.org (the Python Package Index) did the same thing in July, with some amount of criticism from the community: https://news.ycombinator.com/item?id=32037562
by remram 4y ago
pypi.org (the Python Package Index) did the same thing in July, with some amount of criticism from the community: https://news.ycombinator.com/item?id=32037562 https://news.ycombinator.com/item?id=32037562
At least they gave away security keys to try and spin it in a positive light: https://pypi.org/security-key-giveaway/ https://pypi.org/security-key-giveaway/ (well sort of, if you already have 2FA on, no key for you valued maintainer)
- belval 4y agoHonestly that wasn't so bad, I got two Google security keys sent to me at no charge and now I keep one in my pocket and one safely at home. I get the general "You not trusting your dependencies is your problem", but at the same time it's really only a minor annoyance.