3 ms·

Well I don't buy into this cancelling of open tech.

• woodruffw 4y ago
  There is no meaningful sense in which PGP is “canceled”, except in the kind of shitpost sense I would use in a talk slide. Open alternatives exist, are better, and have been better for well over a decade at this point. No significant risk is posed to “open tech” by doing things better than PGP can possibly offer us.
  • benatkin 4y ago
    If you're bluntly calling it "bad" and I take what you said at face value, that sort of cancels it for me. But yeah, it would continue to exist. I didn't mean to suggest it wouldn't. PGP remains on the table for me. A Microsoft-only launch doesn't.
    • woodruffw 4y ago
      There is a strict sense in which PGP does not remain on the table for you, because PyPI does not (and will not, on this developer’s clean conscience) ever support PGP for authentication :-) As said in adjacent threads, PyPI intends to add support for other OIDC providers once they give us the claims we need. Whether or not you choose to use it is ultimately up to you; normal API tokens will continue to work.
      • benatkin 4y ago
        It still is, because I can have my CI use it to determine whether to publish a PyPI package. Nice try though. This is definitely a new low for Python. The main issue is just that it was a Microsoft-only launch. All the rest is just window dressing. It's a good reminder about the Pylance situation in Visual Studio Code. Microsoft tricked people into using closed source. https://ghuntley.com/fracture/ https://ghuntley.com/fracture/