71–80 of 123 posts
I'm very excited to see 2FA become mandatory. It's worth noting that that 2FA requirement will have (virtuous) knock-on effects: package uploads will require an API token instead of allowing a password, meaning one less place where a user can accidentally expose control over their entire account. For packages published through GitHub Actions, PyPI's Trusted Publishing goes a step further and removes the need for a sh…
Edit: Thank you!
While I'm not against security and 2FA in general, making PyPI 2FA mandatory ahead of any kind of org support is a major pain for big projects with more than one maintainer. This week I was forced to link my company's pypi account to a personal device to unblock our latest release and now none of the dozen other maintainers I work with can get access. Things will get spicy if someone in my position were to die, leave…
You can have centralized TOTP too, I believe e.g. Vault or 1password can do that?
Earlier quoted context omitted.
That solves the specific problem, but if you were my coworker, I’d have to toss you off the nearest bridge. Don’t monkeypatch Python, m’kay?
I think it's fine and pythonic[1,2] to monkey patch when used in moderation and done explicitly: from my_patches import monkey monkey.patch_datetime_utcnow() I wouldn't do it as a side-effect of an import. Down that path lies Ruby. :-) [1]: https://www.gevent.org/api/gevent.monkey.html [2]: https://docs.pytest.org/en/6.2.x/monkeypatch.html
But if you're not writing gevent or pytest, you should probably avoid it. It's much better to explicitly import or create the modified version of the code inside your own namespace, like:
from helpers import my_datetime_utcnow
import datetime as dt
def my_datetime_utcnow(): return dt.datetime.whatever...
I'm very excited to see 2FA become mandatory. It's worth noting that that 2FA requirement will have (virtuous) knock-on effects: package uploads will require an API token instead of allowing a password, meaning one less place where a user can accidentally expose control over their entire account. For packages published through GitHub Actions, PyPI's Trusted Publishing goes a step further and removes the need for a sh…
Will PyPi Passkey sign in be supported? Edit: Thank you!
While I'm not against security and 2FA in general, making PyPI 2FA mandatory ahead of any kind of org support is a major pain for big projects with more than one maintainer. This week I was forced to link my company's pypi account to a personal device to unblock our latest release and now none of the dozen other maintainers I work with can get access. Things will get spicy if someone in my position were to die, leave…
You can have centralized TOTP too, I believe e.g. Vault or 1password can do that?
sites implementing 2fa don't make it easy to share the keys (because they shouldn't, that's bad!) but a shared totp key is better than no key.
Earlier quoted context omitted.
Another solution is to make a file called "my_patches.py": import datetime class my_datetime(datetime.datetime): @staticmethod def utcnow(): return datetime.datetime.now(tz=datetime.timezone.utc).replace(tzinfo=None) datetime.datetime = my_datetime And then in your codebase make sure you import my_patches whenever you use datetime. E.g.: import my_patches import datetime print(datetime.datetime.utcnow())
That solves the specific problem, but if you were my coworker, I’d have to toss you off the nearest bridge. Don’t monkeypatch Python, m’kay?
While I'm not against security and 2FA in general, making PyPI 2FA mandatory ahead of any kind of org support is a major pain for big projects with more than one maintainer. This week I was forced to link my company's pypi account to a personal device to unblock our latest release and now none of the dozen other maintainers I work with can get access. Things will get spicy if someone in my position were to die, leave…
TOTP and yubikey are excellent technologies that way. They allow two-factor authentication without breaking privacy.
Everyone within the sound of my voice: get a password manager. It sounds like a hassle but it makes your life infinitely better. It allows you to keep your life private and more secure than it was while providing more convenience than you had before.
I recommend KeepassXC. Open source, audited, fully featured, and can be paired with one of several different kinds of syncing technologies depending on your risk appetite.
If you read nothing else, the commit message adding JIT support is worth your time: https://github.com/python/cpython/pull/113465
To the guy who said the pull was horrible: IMO, the most important thing about a pull request is to... actually be productive. I've worked with people in the past who would nit-pick my commit messages wanting me to waste hours of my time trying to use arcane Git commands. Any of which might and probably will clobber my work. If you're doing Git reviews a good use of resources is to look for security problems, perform…
Is there a PEP 8106 alternative coming for the unittest module too? The naming scheme really looks odd.
Unlikely: https://discuss.python.org/t/enhance-logging-api-with-pep-8-...
I'm still annoyed that they are deprecating datetime.datetime.utcnow(). I have over 1000 references to that function in my projects folder. I understand the footguns that naive datetimes present to the unwary, and yet I still prefer to work with naive always-UTC datetimes. Alas I will end up doing some kind of crazy find-and-replace (at least in the Python 3 code) to something like `datetime.datetime.now(tz=datetime.…