5 ms·
> Authenticating myself with a physical security key. (requested by PyPI) Is that only for some packages? I publish a few obscure ones (not widely used) and ge
by senko 4y ago
> Authenticating myself with a physical security key. (requested by PyPI)
Is that only for some packages? I publish a few obscure ones (not widely used) and get away with just a password.
- Semaphor 4y agoTop 1% get them for free and have to use them from my undrstanding: https://portswigger.net/daily-swig/pypi-repo-to-distribute-4-000-security-keys-to-maintainers-of-critical-projects-in-2fa-drive https://portswigger.net/daily-swig/pypi-repo-to-distribute-4...
- hardolaf 4y agoWhat if the maintainers just say no?
- Conan_Kudo 4y agoWell, PyPI would be in a very bad place, because they can't force them to say "yes". But they've backed themselves into a corner by punishing people for making software that becomes popular. :/
- tlocke 4y agoAs I recall it's mandatory. I can see the package indexes becoming much more involved in supply chain issues. A bit like the app stores, where a considerable amount of vetting goes on.
- senko 4y agoThat's an interesting idea! A "vetted" package index that charges subscription and splits the revenue with package maintainers. In return, maintainers agree to jump through all the extra hoops and index maintainers do extra verification (but still no warranty except that the standard procedure is followed). The same package can then be uploaded to the normal index (as it is now), but without these extra steps, and no vetting.