4 ms·

Instead of throwing the baby out with the bath water, try posting on some python discord channel and educate ur users.

woodruffw 3y ago
As the post says: PGP has been discouraged on PyPI for years, because using it correctly is difficult. The goal here is not to try and carve out the "good" bits, but to drive home that even the remaining users (who were expected to be experts, given that it's no longer advertised) are continuing to use it insufficiently for its stated goals.
- david_draco 3y ago
  Perhaps a good way forward is to come up with a positive incentives, like already exists with the various badges for CI success, test coverage, documentation, valid HTML5, etc. There could be a service that verifies that PGP key can be fetched and the latest pypi version verified. To avoid putting the burden of hosting on you, perhaps you could provide a python script which takes the package name and allows people to self-validate?
  - woodruffw 3y ago
    Positive incentives are a good idea, and PyPI is almost certainly going to apply them to a better code signing solution than PGP.
arp242 3y ago
People have been trying to educate users about PGP for what, 30 years? At some point you got to say "yeah, we gave it our best shot but this is not working, let's try something else!"
- XorNot 3y ago
  Such as? "Something else" is "trust a mega corp". You don't have other options because this entire space is solely about trust.
  - arp242 3y ago
    See my other comment: https://news.ycombinator.com/item?id=36022956 https://news.ycombinator.com/item?id=36022956
    - XorNot 3y ago
      A bunch of utilities which can handle "signing" with some sort of a key isn't a solution. That's not solving the trust problem, which is the actual hard part of GPG. GPG isn't hard to use. It has quirks, but it's not hard - programmers should be able to figure it out. Trust management is hard and no one has solved trust management well. It doesn't make one iota of difference how file signing is done, what matters is whether it can be done in a way which makes the scope, degree and path of trust clear in a way the user can action. Hence my question: because the way we solve "trust" on the internet is "trust a megacorp". The global HTTPS system is based on whichever CAs are shipped in our browsers. And those CAs create global trust - they can issue certificates which say that anything, anywhere is totally who they say they are. Just the Root Certificate Authority process (which isn't bad, but it is just "hey guys, totally trust us").
      - woodruffw 3y ago
        > GPG isn't hard to use. It has quirks, but it's not hard - programmers should be able to figure it out. I've been using GPG for roughly a decade, and I don't think I can consistently reproduce the basic commands I need from memory. I've lost track of the number of times I've corrupted my TTY by forgetting `--armor`, much less the number of times GPG has helpfully "guessed what I mean" in the wrong way. At one point, I had at least 3 different copies of my key bundle on different keyservers. I wouldn't be able to tell you which one is the right one; I can count on a single hand the number of emails I've received encrypted to the right subkey (and on two hands the number of emails encrypted to any key of mine). > Just the Root Certificate Authority process (which isn't bad, but it is just "hey guys, totally trust us"). This isn't true in a useful sense: the CA/B standards are pretty transparent, and the Web PKI mandates transparency (through things like CT) in a publicly auditable way. You can see (and verify) exactly what every CA is doing in the Web PKI, at all times.

As the post says: PGP has been discouraged on PyPI for years, because using it correctly is difficult. The goal here is not to try and carve out the "good" bits, but to drive home that even the remaining users (who were expected to be experts, given that it's no longer advertised) are continuing to use it insufficiently for its stated goals.

david_draco 3y ago
Perhaps a good way forward is to come up with a positive incentives, like already exists with the various badges for CI success, test coverage, documentation, valid HTML5, etc. There could be a service that verifies that PGP key can be fetched and the latest pypi version verified. To avoid putting the burden of hosting on you, perhaps you could provide a python script which takes the package name and allows people to self-validate?
- woodruffw 3y ago
  Positive incentives are a good idea, and PyPI is almost certainly going to apply them to a better code signing solution than PGP.

arp242 3y ago

People have been trying to educate users about PGP for what, 30 years? At some point you got to say "yeah, we gave it our best shot but this is not working, let's try something else!"

XorNot 3y ago
Such as? "Something else" is "trust a mega corp". You don't have other options because this entire space is solely about trust.
- arp242 3y ago
  See my other comment: https://news.ycombinator.com/item?id=36022956 https://news.ycombinator.com/item?id=36022956
  - XorNot 3y ago
    A bunch of utilities which can handle "signing" with some sort of a key isn't a solution. That's not solving the trust problem, which is the actual hard part of GPG. GPG isn't hard to use. It has quirks, but it's not hard - programmers should be able to figure it out. Trust management is hard and no one has solved trust management well. It doesn't make one iota of difference how file signing is done, what matters is whether it can be done in a way which makes the scope, degree and path of trust clear in a way the user can action. Hence my question: because the way we solve "trust" on the internet is "trust a megacorp". The global HTTPS system is based on whichever CAs are shipped in our browsers. And those CAs create global trust - they can issue certificates which say that anything, anywhere is totally who they say they are. Just the Root Certificate Authority process (which isn't bad, but it is just "hey guys, totally trust us").
    - woodruffw 3y ago
      > GPG isn't hard to use. It has quirks, but it's not hard - programmers should be able to figure it out. I've been using GPG for roughly a decade, and I don't think I can consistently reproduce the basic commands I need from memory. I've lost track of the number of times I've corrupted my TTY by forgetting `--armor`, much less the number of times GPG has helpfully "guessed what I mean" in the wrong way. At one point, I had at least 3 different copies of my key bundle on different keyservers. I wouldn't be able to tell you which one is the right one; I can count on a single hand the number of emails I've received encrypted to the right subkey (and on two hands the number of emails encrypted to any key of mine). > Just the Root Certificate Authority process (which isn't bad, but it is just "hey guys, totally trust us"). This isn't true in a useful sense: the CA/B standards are pretty transparent, and the Web PKI mandates transparency (through things like CT) in a publicly auditable way. You can see (and verify) exactly what every CA is doing in the Web PKI, at all times.