5 ms·
Really weird, anyone have some inside gossip on what this is about?
by snapcaster 3y ago
Really weird, anyone have some inside gossip on what this is about?
- Retr0id 3y agoThe most optimistic reason would be that they were investigating a supply-chain attack, or something of that nature.
- commandlinefan 3y agoThis makes me wonder... it's entirely possible that the PyPI people would be enthusiastic about helping to track down offenders, and their users might agree, _if they knew what the offense was_. Instead, they're presented with a typically antagonistic demand for details, so they understandably get defensive on behalf of their users. I wonder if there's not a better, less heavy-handed way to get cooperation with law enforcement when the request is reasonable.
- Retr0id 3y agoPersonally I would rather not set a precedent of handing data over to government agencies just because they ask nicely, even if it seems like it's for a mutually agreeable good cause. That is, I would rather they go through these "formal" channels, even if it seems a bit heavy-handed. Further, whatever they're investigating here is probably "important", for some definition of important, so they likely value the ability to lean on non-disclosure clauses etc.
- bhouston 3y agoI wish it was that but those people would be smart enough to not use their real name when signing up - those doing supply chain attacks are often at least somewhat professional and take precautions. I suspect it was more about going after software that was enabling piracy, those are often created by naive students who are not expecting the power of government to be unleashed on them.
- nibbleshifter 3y ago> those doing supply chain attacks are often at least somewhat professional and take precautions. Not really. The vast majority of supply chain attacks in practice are idiots exploiting namespacing, bitflips, or typos on pypi/npm to drop miners or infostealers. Yes, even the shit tier supply chain attacks count :)
- paulpauper 3y agomaybe to do with web scrapping, auto-posting spam, etc. https://www.developer-tech.com/news/2023/may/22/pypi-suspends-new-projects-and-users-malicious-activity/ https://www.developer-tech.com/news/2023/may/22/pypi-suspend...
- yuvadam 3y agoSubpoenas are from March and April, predating the spamming of the past few weeks.
- richbell 3y agoPyPI has had a pretty consistent spam problem for a while now.
- paulpauper 3y agoit likely shows that it was an ongoing problem
- jamesmurdza 3y agoIt could be related to the large number of malicious or booby-trapped packages that have been uploaded recently to the index.
- foota 3y agoMy guess? A hacking case against someone for typosquatting or malicious packages or something.
- guhcampos 3y agoCould be anything I guess, even legitimate reasons. T Think of the supply-chain attacks going on in the past few years. I'd say investigating these would be a legitimate reason for a subpoena.
- deleted 3y ago[deleted]