> That's how big vendors keep their users' packages up to date What do small vendors, single developers, and hobbyists do? I don't even supply wheels for Micr

> That's how big vendors keep their users' packages up to date What do small vendors, single developers, and hobbyists do? I don't even supply wheels for Microsoft Windows since that's not worth the difficulty. I can't imagine supporting {py3.8, 3.9, 3.10, 3.11} x {deb, rpm, whatever}, and providing installation instructions for the different platforms. For what it's worth, I do host my packages myself, and tell people to: python -m pip install chemfp -i https://chemfp.com/packages/ Luckily, I also have a safety net. I have an old (Python 2.7-only) distribution on PyPI. Even with the instructions, people will do "pip install chemfp" (without the "-i" index URL) and end up installing from PyPI. This then fails, so they either contact me, or read the instructions, or give up. > A compromise would be that new projects added to PyPI go through a vetting system Who will do that? Who will adjudicate conflicts? Who pays for their time? As I understand it, the PyPI maintainers are already pretty busy. I also pointed out how Debichem, a volunteer vetting system for chemistry packages for Debian, aren't able to provide timely vetting. > but it prevents typosquatting and simpler attacks on package integrity. How would it prevent typosquatting? What prevents someone from setting up "chamfp"?