Python.org's been targeted quite enough alright[1]. PyPI is arguably more secure though the surrounding implementations are spotty. You can at least verify the

Python.org's been targeted quite enough alright[1]. PyPI is arguably more secure though the surrounding implementations are spotty. You can at least verify the package uploader's identity with some certainty using PyPISSH[2], and sign your package with GPG[3]. The problem is, PyPISSH and signing your package with GPG are not required for compatibility reasons. [1]: http://wiki.python.org/moin/WikiAttack2013 http://wiki.python.org/moin/WikiAttack2013 [2]: http://pypi.python.org/pypi/pypissh http://pypi.python.org/pypi/pypissh [3]: http://pypi.python.org/security http://pypi.python.org/security