3 ms·
> The volume of malicious users and malicious projects being created on the index in the past week has outpaced our ability to respond to it in a timely fashion
by efitz 3y ago
> The volume of malicious users and malicious projects being created on the index in the past week has outpaced our ability to respond to it in a timely fashion, especially with multiple PyPI administrators on leave.
People suck and that is why we cannot have nice things.
- Hnrobert42 3y agoThe shame of it is that a tiny, tiny, tiny fraction of people really suck. The number of people involved is probably less than a thousand. (This is my totally uninformed speculation.)
- deleted 3y ago[deleted]
- miohtama 3y agoIt’s calle Tragedy of Commons https://en.m.wikipedia.org/wiki/Tragedy_of_the_commons https://en.m.wikipedia.org/wiki/Tragedy_of_the_commons One solution would be have a minimum payment or a trusted sponsor in order to register a new package. A minimum trust score through well-known community persons, or reduce spam by payments. On the root cause why people suck is that different cultures and different people have different values. For many people making money by spamming is not an issue in their own internal value system. Thus, it is better to be tackled by making spam unprofitable.
- checkyoursudo 3y agoI disagree that this is a case of tragedy of the commons (totc). Totc is about unregulated depletion of resources, just like your link says. This pypi stuff is about maliciousness. Criminal or misanthropic behavior is not totc; it's just antisocial. Also, https://aeon.co/essays/the-tragedy-of-the-commons-is-a-false-and-dangerous-myth https://aeon.co/essays/the-tragedy-of-the-commons-is-a-false...
- logdap 3y ago[dead]
- donio 3y agoYes, people suck and I wish they didn't but the other side of the problem is that the centralized flat-namespace model of PyPI is especially vulnerable.