3 ms·

I think this is the wrong problem they are addressing. They should allow malicious users to be a possibility but what is lacking is package authentication/signi

by _8j50 3y ago

I think this is the wrong problem they are addressing. They should allow malicious users to be a possibility but what is lacking is package authentication/signing. Sign all packages, new users get the worst grade, users with a lot of downloads over a long period get a slightly better grade then have different levels if trusted third party reviewed grades. For new users' packages you get a big red warning that needs to be confirmed and bypassed in multiple ways with a message like "ERROR:THIS PACKAGE IS FROM AN ILL-REPUTED SOURCE, IT IS LIKELY MALICIOUS AND HASN'T UNDERGONE HUMAN REVIEW" kind of scream at you a little.

woodruffw 3y ago
Codesigning is something that's actively being worked on for PyPI. It won't have that kind of "noob" reputation scheme, though: those kinds of schemes (1) effectively punish newcomers for daring to contribute to an ecosystem, and (2) are incredibly hard to build trust policies around (what's the trust gradation between "new package" and "very old package with a new maintainer"?).
- _8j50 3y ago
  The grade is for the maintainer not the package. It does punish newcomers but that's the point, newcomers cannot be trusted. People don't search for packages directly on pypi, they find them elsewhere and then use pypi to install it. If you are a new maintainer, you build reputation elsewhere and ask users to ignore the warning on pypi. After say 1k unique downloads and 90 day probation, you move to the next level with a less serious warning. To avoid all that though, you can purchase a code signing certificate and verify your identity (with pypi not just the ca) and even as a new comer there will be no warning for your packages. After observing many such systems my view is that you have to make up your mind and have a rigid and reliable reputation system or have none at all. The middle is the most dangerous place for everyone but I fear open source people like to repeat mistakes and sacrifice the safety of their users for the sake of ideology. Newcomer+ no known reputation+unverified = warn people

by _8j50 3y ago

woodruffw 3y ago

Codesigning is something that's actively being worked on for PyPI. It won't have that kind of "noob" reputation scheme, though: those kinds of schemes (1) effectively punish newcomers for daring to contribute to an ecosystem, and (2) are incredibly hard to build trust policies around (what's the trust gradation between "new package" and "very old package with a new maintainer"?).

_8j50 3y ago
The grade is for the maintainer not the package. It does punish newcomers but that's the point, newcomers cannot be trusted. People don't search for packages directly on pypi, they find them elsewhere and then use pypi to install it. If you are a new maintainer, you build reputation elsewhere and ask users to ignore the warning on pypi. After say 1k unique downloads and 90 day probation, you move to the next level with a less serious warning. To avoid all that though, you can purchase a code signing certificate and verify your identity (with pypi not just the ca) and even as a new comer there will be no warning for your packages. After observing many such systems my view is that you have to make up your mind and have a rigid and reliable reputation system or have none at all. The middle is the most dangerous place for everyone but I fear open source people like to repeat mistakes and sacrifice the safety of their users for the sake of ideology. Newcomer+ no known reputation+unverified = warn people