4 ms·
> The privacy of PyPI users is of utmost concern to PSF and the PyPI Administrators, and we are committed to protecting user data from disclosure whenever possi
by avgcorrection 3y ago
> The privacy of PyPI users is of utmost concern to PSF and the PyPI Administrators, and we are committed to protecting user data from disclosure whenever possible.
Don’t lead with this.
> In this case, however, PSF determined with the advice of counsel that our only course of action was to provide the requested data.
If you’re going to say this.
I’m not judging their decision. Maybe not going to prison is a greater concern to them. It’s fine to just say that you thought it was best to comply because [lawyer reasons that you don’t have to disclose to anyone]/counsel.
EDIT: Or say “there are bad people out there and we trust the DOJ”. Whatever.
- tptacek 3y agoLighten up. Nobody's going to federal court to stop the DOJ from investigating botnets, carding rings, and ransomware scams, which is what these things are usually about. Nobody's mental model of PyPI was that they had Signal's priorities.
- avgcorrection 3y agoThen all the less reason to roll out the “of utmost importance” boilerplate. So what’s your point? Also I don’t see how being light-hearted has anything to do with this submission, Thomas.
- davidguetta 3y agoIts just they have no choice. And when they do the choose their "utmost priority". Its not that complicated
- mrguyorama 3y agoThen they shouldn't say protecting their users are their top priority, because they have shown it is not. That's called lying. A correct statement would have been "we will comply with lawful LEO requests"
- x0x0 3y agoHelping convict scammers, typo-squatters injecting malicious code, etc is protecting their users. Just not the (likely) bad actors that are the subject of the subpoenas.
- hgsgm 3y agoThe fact remains, that unless you are willing to break the law, obeying the law is your top priority.
- junon 3y agoIf you're so inclined, you're welcome to make an anarcho-oriented package management system yourself. PyPi has never claimed to be one, though.
- ewdurbin 3y agoThis assumes that all of this is binary, when in reality it’s a complex system that takes time and effort to modify in a meaningful and responsible way.
- junon 3y agoHow have they shown it's not, exactly? Really curious what you think they could have done better aside from blatantly going against laws in their jurisdiction.
- adamckay 3y agoThere's a difference between abiding by lawful court orders that have gone through judicial process and a friend in a police department calling in a favour.
- deleted 3y ago[deleted]
- paulgb 3y agoIt's a completely reasonable reading of their message to assume that the “possible” in “whenever possible” roughly means “legal”. I don't think any reasonable reading of it means to imply that they are willing to violate federal law.
- avgcorrection 3y agoFair point.
- Mystery-Machine 3y agoOke way to protect user data is to NOT ask/collect data in the first place. What's the need of person's full name and address for? Maybe I'm missing the point, but I see zero reasons to have this data in the first place.
- avgcorrection 3y agoThat’s the best principle to follow. Agreed.
- masto 3y agoIf you read the whole thing, it's pretty clear they don't have the person's full name and address, and thus did not provide it. They do mention that it will be needed for organizations that sign up for billing when that feature becomes available. Other than possibly IP addresses, it seems like the only information they had available to disclose was close to the bare minimum needed to operate the service.
- dubbel 3y agoYou are probably reading what data the DoJ requested. Further down in the blogpost (in the "Details" section) they state that they don't have a lot of the data requested and exactly what kind of data they could and did provide. Addresses are not requested by PyPI.
- junon 3y agoAnd they state very clearly they don't have this information. In fact, PyPi seems to retain a very reasonable set of information, strictly related to the service itself. I found this disclosure to be entirely refreshing.
- duxup 3y agoI don’t see anything conflicting in what they said. They can feel that way, and comply.
- avgcorrection 3y agoYeah. I was probably being a little too boilerplate (what looked like) -intolerant. ;)