3 ms·
I want to see better supply chain security but the main thing I see here is that PyPI is partnering solely with Microsoft on this and it seems like a huge bumme
by benatkin 4y ago
I want to see better supply chain security but the main thing I see here is that PyPI is partnering solely with Microsoft on this and it seems like a huge bummer. As another comment mentioned, PyPI is lacking in curation and this doesn't address it.
- woodruffw 4y agoSee other replies: I think it’s inaccurate to call this a partnership or endorsement. GitHub being the initially supported publishing platform is primarily a matter of expedience and greatest impact.
- duskwuff 4y ago> the main thing I see here is that PyPI is partnering solely with Microsoft on this This is addressed towards the end of the post. PyPI intends to support other publishers in the future. > PyPI is lacking in curation and this doesn't address it I'm not sure how that's related. This is a security feature; it has nothing to do with curation.
- benatkin 4y ago> This is addressed towards the end of the post. PyPI intends to support other publishers in the future. By dressing them down publicly for not supporting an obscure API.
- woodruffw 4y agoOpenID Connect is not particularly obscure. I’d say it’s within a standard deviation of OAuth (since it is OAuth2), which is both widely known and widely deployed.
- benatkin 4y agoHmm, this seems like more drubbing of those who don't do the same thing Microsoft does. To me OpenID makes me think of SSO. https://sso.tax/ https://sso.tax/ Can be open but is enterprisey.