Viewing profile — donaldstufft

There is zero chance we require biometrics on PyPI.

You can have multiple accounts associated with a single project, so each person can have their own account and you just add them all as owners to the projects. That can be annoying…

That's great! While we strive to make PyPI useful for everyone we totally understand that sometimes the trade offs we have to make just don't work for everyone so we try really har…

TOTP is a good choice, and helps a lot on keeping everyone's account safe! Thanks a lot for taking the time to investigate your options I do feel want to mention though (largely be…

One important thing to remember here is that PyPI was originally started in 2002 as a weekend hack project that grew overtime to become the piece of critical infrastructure it is t…

So there's a few things here: Firstly, Debian's mirror network URLs allow a mirror operator to attack the base Debian.org site if they rely on cookies on debian.org (they may not, …

The root of trust for uploads is the listed of signatures maintained by the archive administrators, flat out. The requirement for having individual keys signed by Debian Developers…

Well, AFAIK it's not clear that in the US the courts have the right to compel someone to modify their software in that way. The FBI holds that it does, but so far it's been fought …

> Before you can submit packages to Debian you have to get an existing Debian developer to sign your PGP key. In Debian the trust flows downward from older developers to newer deve…

This post is pretty misleading. PyPI still fully supports mirrors (though it is becoming increasingly hard to run a full mirror of PyPI, last I looked a full copy of PyPI is about …

I would resign from PyPI before I ever allowed a backdoor to be installed. I haven't explicitly asked, but I would be very surprised if any of the other PyPI admins felt differentl…

I agree that long lived GPG keys are a bad idea, which is yet another reason why the feature was a bad one, because it could only ever work with non expiring GPG keys.

Well PGP signatures has been part of PyPI for 18 years now, if someone was going to build a secure system on top of that, they would have by now. PyPI should implement it though, b…

Sometimes? There's no global policy of doing it in Debian, it's up to individual package maintainers inside of Debian to enable it (it defaults to off AFAIK) and to hardcode the ke…

I don't believe that Maven Central's use of GPG is providing a meaningful security control here, so I would dispute the idea that they're doing it "right".

The current documented plans revolve around TUF ( https://peps.python.org/pep-0458/ , https://peps.python.org/pep-0480/ ). Those links have probably bit rotted a bit by now, progre…

> The PyPI admins can provide their own rationale, but this is my best understanding: they have known for years that PGP is bad, and have more or less tolerated it as a legacy feat…

The current expectation is it will be a combination of sigstore and TUF, but if someone proposes something better then we're open to that. Implementing those things takes time thou…

I'm not a huge expert on Sigstore, but I believe it's better to think of sigstore as similar to Certificate Transparency than similar to GPG signatures. The idea being that signatu…

With my PyPI administrator hat on, we have absolutely zero desire to ban anyone from PyPI for anything other than their actions on PyPI and in the Python ecosystem (uploading malwa…

It is true that an unverified TLS session does prevent passive attacks it does not prevent against "active" attacks. The general consensus is that it's not a useful property to dif…

I wonder if the domain being `blog.pypi.org` tipped them off?

Assuming of course that the other attacker doesn't just MITM the first attacker. But this is a very silly threat model, "I want exactly one person to be able to attack me at a time…

With self signed certificates your ISP can just serve their own self signed certificate, and then inject ads into the recipe blog.

I don't believe they would. Looking at the top 20 packages in the last month by download (packages with hundreds of millions of downloads), only 1 of them shipped a GPG signature w…