ewdurbin

3 ms·

1. 1.▲
   by ewdurbin 3y ago

   I took a report down within 3 minutes of upload today. We have regularly received comments from our 3rd-party reporters that we are the most responsive. You are wrong.
2. 2.▲
   by ewdurbin 3y ago

   This assumes that all of this is binary, when in reality it’s a complex system that takes time and effort to modify in a meaningful and responsible way.
3. 3.▲
   by ewdurbin 3y ago

   no. they wanted the downloads by randoms. we don’t store those with IPs
4. 4.▲
   by ewdurbin 3y ago

   Python release files have been signed with sigstore for the last couple versions. You can peruse the release tooling that uses it at https://github.com/python/release-tools
5. 5.▲
   by ewdurbin 3y ago

   there are no plans to limit trusted publishers. in fact there is another in the works: https://github.com/pypi/warehouse/issues/13551
6. 6.▲
   PyPI will no longer accept passwords that have been published in data breaches(caremad.io)

   2 points by ewdurbin 8y ago|0 comments
7. 7.▲
   Pushing AWS Lambda and API Gateway to the Ragged Edge with Python(gitlab.com)

   8 points by ewdurbin 9y ago|1 comments