Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What's up Python? Epic CPython commit, Django 5 and 2FA for PyPI

bitecode.dev

Post reply on HN
Print view View original

41–50 of 123 posts

Re: What's up Python? Epic CPython commit, Django 5 and 2FA for PyPI

#41

Post by amelius »

aftbit wrote: post #34

I'm still annoyed that they are deprecating datetime.datetime.utcnow(). I have over 1000 references to that function in my projects folder. I understand the footguns that naive datetimes present to the unwary, and yet I still prefer to work with naive always-UTC datetimes. Alas I will end up doing some kind of crazy find-and-replace (at least in the Python 3 code) to something like `datetime.datetime.now(tz=datetime.…

Another solution is to make a file called "my_patches.py":

    import datetime

    class my_datetime(datetime.datetime):
        @staticmethod
        def utcnow():
            return datetime.datetime.now(tz=datetime.timezone.utc).replace(tzinfo=None)

    datetime.datetime = my_datetime
And then in your codebase make sure you import my_patches whenever you use datetime. E.g.:

    import my_patches
    import datetime

    print(datetime.datetime.utcnow())

Re: What's up Python? Epic CPython commit, Django 5 and 2FA for PyPI

#42

Post by pkkm »

japanman185 wrote: post #8

[flagged]

Can you elaborate on the issues you've seen? Was the code haphazardly thrown together, or did it follow the usual modern practices (pip-tools or Poetry, dataclasses, type checking, Pydantic, etc.) and still suffer the problems?

Re: What's up Python? Epic CPython commit, Django 5 and 2FA for PyPI

#43

Post by jurassic »

sakjur wrote: post #40
jurassic wrote: post #36

While I'm not against security and 2FA in general, making PyPI 2FA mandatory ahead of any kind of org support is a major pain for big projects with more than one maintainer. This week I was forced to link my company's pypi account to a personal device to unblock our latest release and now none of the dozen other maintainers I work with can get access. Things will get spicy if someone in my position were to die, leave…

You can have centralized TOTP too, I believe e.g. Vault or 1password can do that?

Good to know, I wasn't aware. But if you're storing passwords, TOTP seed, and recovery codes all in the same shared password vault, it's not really multi-factor anymore. It's security theatre.

Re: What's up Python? Epic CPython commit, Django 5 and 2FA for PyPI

#44

Post by ptx »

woodruffw wrote: post #19
IshKebab wrote: post #17

2FA but still no namespaces? Dependency confusion attacks are still trivial on PyPI.

Namespacing does not prevent (or even significantly complicate) dependency confusion, unless we think that there's some difference in confusability between these two errors: requestss and requestss/requests (I think namespacing is a good idea in general, but dependency confusion is mostly a disjoint namespaces problem, not a depth problem. Python could solve the former by doing what Go does and make the source reposi…

It does help in some cases.

For example, I know that "kotlin-stdlib-jdk8" in Maven Central is the official package for Kotlin standard library, but what about "kotlin-stdlib-wasm-wasi", "kotlin-jdk-annotations" and "kotlin-native-compiler-embeddable"? Here it helps to know that they're all in the "org.jetbrains.kotlin" group.

Re: What's up Python? Epic CPython commit, Django 5 and 2FA for PyPI

#45

Post by syndicatedjelly »

japanman185 wrote: post #8

[flagged]

Python is not a scripting language, it's a weakly-typed general-purpose programming language. I too dislike the lack of strong-typing, but there are dozens of good options if that's what I need in a codebase.

It sounds like your problem is with people who write Python, not Python itself. Not every person who writes code has the time or ability to learn all the nuances of strongly-typed functional languages. In my opinion, people outside of software engineering shouldn't bother with such esoteric domain knowledge. "Real" programmers like yourself are there for that reason - to rewrite their prototyped code in whatever style you see fit.

Complaining that they don't know how to program is a great way to alienate smart people in other domains. Knowledge of computer science tends to blow up people's egos in a way that I have observed in few other fields.

Re: What's up Python? Epic CPython commit, Django 5 and 2FA for PyPI

#46

Post by xkcd-sucks »

jurassic wrote: post #43
sakjur wrote: post #40

Earlier quoted context omitted.

You can have centralized TOTP too, I believe e.g. Vault or 1password can do that?

Good to know, I wasn't aware. But if you're storing passwords, TOTP seed, and recovery codes all in the same shared password vault, it's not really multi-factor anymore. It's security theatre.

financial security if you can pin it all on your paid password manager service and they remain solvent enough to juice

Re: What's up Python? Epic CPython commit, Django 5 and 2FA for PyPI

#47

Post by Karellen »

aftbit wrote: post #34

I'm still annoyed that they are deprecating datetime.datetime.utcnow(). I have over 1000 references to that function in my projects folder. I understand the footguns that naive datetimes present to the unwary, and yet I still prefer to work with naive always-UTC datetimes. Alas I will end up doing some kind of crazy find-and-replace (at least in the Python 3 code) to something like `datetime.datetime.now(tz=datetime.…

> I still prefer to work with naive always-UTC datetimes.

Why prefer to work with naive UTC datetimes, rather than explicit UTC datetimes?

What's wrong with plain `datetime.datetime.now(datetime.UTC)`?

Re: What's up Python? Epic CPython commit, Django 5 and 2FA for PyPI

#50

Post by coder543 »

jurassic wrote: post #43
sakjur wrote: post #40

Earlier quoted context omitted.

You can have centralized TOTP too, I believe e.g. Vault or 1password can do that?

Good to know, I wasn't aware. But if you're storing passwords, TOTP seed, and recovery codes all in the same shared password vault, it's not really multi-factor anymore. It's security theatre.

No, it’s not theater.

2FA was not created as a defense against password manager compromise. That is not its purpose. It protects against password reuse attacks and helps to protect against total compromise of people who have been phished.

Even better, a password manager can avoid giving up a TOTP code to a phisher in the first place because it is checking the domain.

If your password manager is compromised, you’ve got big problems regardless of 2FA tokens being in there or not.

The extremely marginal security benefit of storing the 2FA tokens separate from your password manager is just not even worth discussing in most scenarios. It exists, but doing that causes the additional risks of losing access to your 2FA token or having your 2FA code phished, both of which seem a lot more likely than your password manager being compromised. At least, as long as you’re using any halfway decent password manager.

Long term, the goal is to get rid of passwords and 2FA altogether by switching to Passkeys. Each Passkey will naturally be stored in a single place, since they can’t be split into multiple parts anyways.

Post reply on HN