2 ms·
They’re running the most popular registry but nothing says you can’t use your own to implement whatever policy you want. The default registry has a tricky balan
by acdha 10mo ago
They’re running the most popular registry but nothing says you can’t use your own to implement whatever policy you want. The default registry has a tricky balance of needing to support inexperienced users while also only having a very modest budget compared to the companies which depend on it, and things like custom authentication flows are disproportionately expensive.
- pamcake 10mo agoWhat's the issue exactly? They seem to manage to handle account signups with email addresss from unknown domain names just as fine as for hotmail.com and gmail.com. I don't see how this is any different. The whole point of standards like OIDC (and supposedly TP) is that there is no need for provider-specific implemenations or custom auth flows as long as you follow the spec and protocol. It's just some fields that can be put in a settings UI configurable by the user.
- woodruffw 10mo agoIt’s completely different. An email signup doesn’t involve a persistent trust relationship between PyPI and an OIDC identity provider. The latter imposes code changes, availability requirements, etc. (But also: for completely unrelated reasons, PyPI can and will ban email domains that it believes are sources of abuse.)