3 ms·

If you delete your package, can't someone else grab the namespace? I see that as the main issue if you want to migrate away from PyPI's management practices.

If you delete your package, can't someone else grab the namespace? I see that as the main issue if you want to migrate away from PyPI's management practices. Similarly, if you don't want to deal with PyPI at all, and host your own packages, then it's all too easy for someone else to register a package of the same name on PyPI. Users aren't used to configuring an alternate server.

jjgreen 3y ago
Very possibly, but I don't have a phone or a hardware key, and I'm certainly not going out and getting one for the benefit of PyPI, so my choices are? Having an outdated version of my packages on a locked-out account on PyPI (with the up-to-date sdists that I distribute on my website) sounds like a nightmare.
- multani 3y ago
  There's a number of offline, opensource, TOTP CLI applications, so just use one of them for instance?
  - jjgreen 3y ago
    Those can be used? That could be a way around this then, thanks -- I'll investigate (just going on @badsectoracula's comment that phone or key is required, possibly I misinterpreted that). Still something of a PITA though (and not really a second factor).
    - arcanemachiner 3y ago
      KeepassXC is great. Just keep a copy of your .kbdx file synced to a backup location.
- vasachi 3y ago
  Well, that is your right as an owner of the packages. By the way, what are those packages?
  - jjgreen 3y ago
    Some low-traffic maths stuff I made for myself (but others are welcome to use): https://pypi.org/user/jjg/ https://pypi.org/user/jjg/
- dalke 3y ago
  I also don't have a smart phone or hardware key, and feel the same. I host my packages on my own server using the PEP 503 "Simple Repository API". (For what it's worth, Donald Stufft, author of this PyPI blog post, also wrote PEP 503.) I migrated away from PyPI years ago because modern FOSS distribution is increasingly intermediated by package managers, which I think worsens the connection between user and producer by adding a layer of anonymity. I see 2FA as a technical work-around using mechanical trust instead of personal trust. I don't care if people who don't know about me or my project web site can't find it on PyPI, because care is reciprocal - I want them to care about me too, at least enough to know where the project came from. That's where I think trust comes from. My packages will never be popular. I develop very specialized software for a field with perhaps 10,000 world-wide users. No one will pay for my software, or hire my services, if they only visit PyPI. I thankfully still have a Python 2.7 version of my software on PyPI. I haven't deleted it, to make name-squatting harder. It's even lead people to contact me directly, to ask about Python 3 support. I never would have heard from them, had I published the newest versions on PyPI, and that direct contact breaks the anonymity PyPI interposes. A nice plus is how hosting means I have full access to the download logs, giving me insight onto what platforms people use that PyPI doesn't provide, because "anonymity". The biggest annoyance is they main reason I started using PyPI was because someone else added another project of mine to PyPI. I distributed https://pypi.org/project/PyRSS2Gen/ https://pypi.org/project/PyRSS2Gen/ on my own web site as source. Someone else added it to PyPI, with me listed as the primary developer. I didn't know about it until the PyPI devs emailed developers like me to encourage them to support Python 3! I then had to ask that stranger for access to the PyPI entry. I fear that will happen again, if I ever develop a new package that I distribute myself. I hope this provide something for you to chew on, as you consider what you might do.
  - donaldstufft 3y ago
    That's great! While we strive to make PyPI useful for everyone we totally understand that sometimes the trade offs we have to make just don't work for everyone so we try really hard to enable folks like yourself to be able to set up their own repositories. I'm glad that it's working out for you and that you've got a setup you like. I do want to mention two things: We've got a PEP (PEP 708) going through the works that will tighten the security model around multiple repositories down some more. If I understand your uses well enough you should be able to add a line or two of HTML to your repository and not have any interruptions or warnings. That PEP isn't accepted yet or implemented or anything, but something to keep in the back of your mind at least. While we don't make any sort of raw download logs available, we do publish what is essentially a query-able database of download events that have been parsed already to make it easy to see those stats. We do have a little bit of redaction on those events, primarily to avoid leaking PII like IP addresses and such, where instead of an IP address we log broad geographical area (country I think?). If anyone is curious to see that, it's hosted in Google BigQuery (sorry, it does require a Google account) and there's a guide at https://packaging.python.org/en/latest/guides/analyzing-pypi-package-downloads/ https://packaging.python.org/en/latest/guides/analyzing-pypi... that tells you more about it.

jjgreen 3y ago

Very possibly, but I don't have a phone or a hardware key, and I'm certainly not going out and getting one for the benefit of PyPI, so my choices are? Having an outdated version of my packages on a locked-out account on PyPI (with the up-to-date sdists that I distribute on my website) sounds like a nightmare.

multani 3y ago
There's a number of offline, opensource, TOTP CLI applications, so just use one of them for instance?
- jjgreen 3y ago
  Those can be used? That could be a way around this then, thanks -- I'll investigate (just going on @badsectoracula's comment that phone or key is required, possibly I misinterpreted that). Still something of a PITA though (and not really a second factor).
  - arcanemachiner 3y ago
    KeepassXC is great. Just keep a copy of your .kbdx file synced to a backup location.
vasachi 3y ago
Well, that is your right as an owner of the packages. By the way, what are those packages?
- jjgreen 3y ago
  Some low-traffic maths stuff I made for myself (but others are welcome to use): https://pypi.org/user/jjg/ https://pypi.org/user/jjg/
dalke 3y ago
I also don't have a smart phone or hardware key, and feel the same. I host my packages on my own server using the PEP 503 "Simple Repository API". (For what it's worth, Donald Stufft, author of this PyPI blog post, also wrote PEP 503.) I migrated away from PyPI years ago because modern FOSS distribution is increasingly intermediated by package managers, which I think worsens the connection between user and producer by adding a layer of anonymity. I see 2FA as a technical work-around using mechanical trust instead of personal trust. I don't care if people who don't know about me or my project web site can't find it on PyPI, because care is reciprocal - I want them to care about me too, at least enough to know where the project came from. That's where I think trust comes from. My packages will never be popular. I develop very specialized software for a field with perhaps 10,000 world-wide users. No one will pay for my software, or hire my services, if they only visit PyPI. I thankfully still have a Python 2.7 version of my software on PyPI. I haven't deleted it, to make name-squatting harder. It's even lead people to contact me directly, to ask about Python 3 support. I never would have heard from them, had I published the newest versions on PyPI, and that direct contact breaks the anonymity PyPI interposes. A nice plus is how hosting means I have full access to the download logs, giving me insight onto what platforms people use that PyPI doesn't provide, because "anonymity". The biggest annoyance is they main reason I started using PyPI was because someone else added another project of mine to PyPI. I distributed https://pypi.org/project/PyRSS2Gen/ https://pypi.org/project/PyRSS2Gen/ on my own web site as source. Someone else added it to PyPI, with me listed as the primary developer. I didn't know about it until the PyPI devs emailed developers like me to encourage them to support Python 3! I then had to ask that stranger for access to the PyPI entry. I fear that will happen again, if I ever develop a new package that I distribute myself. I hope this provide something for you to chew on, as you consider what you might do.
- donaldstufft 3y ago
  That's great! While we strive to make PyPI useful for everyone we totally understand that sometimes the trade offs we have to make just don't work for everyone so we try really hard to enable folks like yourself to be able to set up their own repositories. I'm glad that it's working out for you and that you've got a setup you like. I do want to mention two things: We've got a PEP (PEP 708) going through the works that will tighten the security model around multiple repositories down some more. If I understand your uses well enough you should be able to add a line or two of HTML to your repository and not have any interruptions or warnings. That PEP isn't accepted yet or implemented or anything, but something to keep in the back of your mind at least. While we don't make any sort of raw download logs available, we do publish what is essentially a query-able database of download events that have been parsed already to make it easy to see those stats. We do have a little bit of redaction on those events, primarily to avoid leaking PII like IP addresses and such, where instead of an IP address we log broad geographical area (country I think?). If anyone is curious to see that, it's hosted in Google BigQuery (sorry, it does require a Google account) and there's a guide at https://packaging.python.org/en/latest/guides/analyzing-pypi-package-downloads/ https://packaging.python.org/en/latest/guides/analyzing-pypi... that tells you more about it.