>And even then, for this attack to be meaningful you'd need to have active MITM between the server and PyPI or rubygems Yeah. Which is pretty much the thing (o

>And even then, for this attack to be meaningful you'd need to have active MITM between the server and PyPI or rubygems Yeah. Which is pretty much the thing (or one of the things anyway) that TLS is supposed to prevent! >These are activities usually triggered by developers or administrators, not by web servers remotely and they have to do with a web application, not a web server. Some strange distinctions. A server running a web application may well want to make requests to PyPI when being provisioned.