6 ms·

Is this an extension of the supposed NSL? Demands from USA TLAs to be able to match users to projects would seems to fit with the story as it was presented on H

Is this an extension of the supposed NSL? Demands from USA TLAs to be able to match users to projects would seems to fit with the story as it was presented on HN (PyPI responded to a demand for all data, including use data, related to certain projects; https://news.ycombinator.com/item?id=36061407 https://news.ycombinator.com/item?id=36061407). Could equally come from the project, looking at their past HN stories they've had a lot of problems with malicious users. ID requirements might reduce that.

eesmith 3y ago
No, it isn't an extension. It's been in the works for a while. PyPI started supporting 2FA 4 years ago (HN at https://news.ycombinator.com/item?id=20055340 https://news.ycombinator.com/item?id=20055340 ) and last year required 2FA for the most widely used accounts (HN at https://news.ycombinator.com/item?id=32058053 https://news.ycombinator.com/item?id=32058053 ). One of the objections about it at the time was on HN at https://news.ycombinator.com/item?id=32037562 https://news.ycombinator.com/item?id=32037562 . I think another Python dev didn't want to deal with 2FA and stopped the project, but I can't find that link. In any case, this multi-year phase-in is the sort of ratcheting steps you do when you want to make a change, and it's a big change, and you don't want a flag-day migration. Or, if you don't like it, you use the boiling frog apologue - https://en.wikipedia.org/wiki/Boiling_frog https://en.wikipedia.org/wiki/Boiling_frog .
- burningion 3y ago
  hey ee just wanted to say thanks for all your work, you're doing so much for the python ecosystem. genuinely appreciate all you're doing, you're a great example for the rest of us.
  - eesmith 3y ago
    I suspect you are confusing me for Ee Durbin, Director of Infrastructure at the PSF. I'm not doing anything for the Python ecosystem. I'm a Python developer, not part of core dev, PyPI, Python packaging, or anything ecosystem related.
    - burningion 3y ago
      Yes! If you see this ee, thanks!

eesmith 3y ago

No, it isn't an extension. It's been in the works for a while. PyPI started supporting 2FA 4 years ago (HN at https://news.ycombinator.com/item?id=20055340 https://news.ycombinator.com/item?id=20055340 ) and last year required 2FA for the most widely used accounts (HN at https://news.ycombinator.com/item?id=32058053 https://news.ycombinator.com/item?id=32058053 ). One of the objections about it at the time was on HN at https://news.ycombinator.com/item?id=32037562 https://news.ycombinator.com/item?id=32037562 . I think another Python dev didn't want to deal with 2FA and stopped the project, but I can't find that link. In any case, this multi-year phase-in is the sort of ratcheting steps you do when you want to make a change, and it's a big change, and you don't want a flag-day migration. Or, if you don't like it, you use the boiling frog apologue - https://en.wikipedia.org/wiki/Boiling_frog https://en.wikipedia.org/wiki/Boiling_frog .

burningion 3y ago
hey ee just wanted to say thanks for all your work, you're doing so much for the python ecosystem. genuinely appreciate all you're doing, you're a great example for the rest of us.
- eesmith 3y ago
  I suspect you are confusing me for Ee Durbin, Director of Infrastructure at the PSF. I'm not doing anything for the Python ecosystem. I'm a Python developer, not part of core dev, PyPI, Python packaging, or anything ecosystem related.
  - burningion 3y ago
    Yes! If you see this ee, thanks!