Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What's up Python? Epic CPython commit, Django 5 and 2FA for PyPI

bitecode.dev

Post reply on HN
Print view View original

81–90 of 123 posts

Re: What's up Python? Epic CPython commit, Django 5 and 2FA for PyPI

#81

Post by whalesalad »

gmassman wrote: post #63
Karellen wrote: post #47

Earlier quoted context omitted.

> I still prefer to work with naive always-UTC datetimes. Why prefer to work with naive UTC datetimes, rather than explicit UTC datetimes? What's wrong with plain `datetime.datetime.now(datetime.UTC)`?

I’m also curious to know why OP prefers naive to tz aware datetimes. IMO naive datetimes are a bad default, and `utcnow()` deserves to be deprecated.

Because many engineers decided long ago that you’d handle these concerns at the perimeter and assume UTC everywhere internally. Should and can be a decision left to the developer, no reason to take this away.

Re: What's up Python? Epic CPython commit, Django 5 and 2FA for PyPI

#82

Post by cassianoleal »

notatoad wrote: post #75
sakjur wrote: post #40

Earlier quoted context omitted.

You can have centralized TOTP too, I believe e.g. Vault or 1password can do that?

you can also just screenshot the QR code they give you to register your TOTP authenticator, and share it with the other maintainers. sites implementing 2fa don't make it easy to share the keys (because they shouldn't, that's bad!) but a shared totp key is better than no key.

> sites implementing 2fa don't make it easy to share the keys

Sites that offer TOTP as a second factor normally either have the seed printed out next to the QR code, or have a button (or link) to show it.

It's a major hassle to scan a QR code from the laptop screen without leaving the laptop, whereas copy-pasting the seed into the password manager is easy. Pasting it somewhere you can share with other people is just as easy since the seed is just a string of characters.

There's also the fact that TOTP is an open standard, so one could very easily implement a bit of software that translated the QR code into the seed, so there's really no point at all for websites to try to protect the seed from the user. The user owns the seed and the code.

Re: What's up Python? Epic CPython commit, Django 5 and 2FA for PyPI

#83

Post by LtWorf »

jurassic wrote: post #43
sakjur wrote: post #40

Earlier quoted context omitted.

You can have centralized TOTP too, I believe e.g. Vault or 1password can do that?

Good to know, I wasn't aware. But if you're storing passwords, TOTP seed, and recovery codes all in the same shared password vault, it's not really multi-factor anymore. It's security theatre.

From the same team that decided to drop signatures… unsurprising.

Re: What's up Python? Epic CPython commit, Django 5 and 2FA for PyPI

#84

Post by LtWorf »

woodruffw wrote: post #15

I'm very excited to see 2FA become mandatory. It's worth noting that that 2FA requirement will have (virtuous) knock-on effects: package uploads will require an API token instead of allowing a password, meaning one less place where a user can accidentally expose control over their entire account. For packages published through GitHub Actions, PyPI's Trusted Publishing goes a step further and removes the need for a sh…

To create a new package, you MUST generate a global token that can also do whatever on all existing packages on the account.

How many people do you think will bother to delete the global token after having used it, and then generate a scoped one? 1%? Probably much less than that.

Re: What's up Python? Epic CPython commit, Django 5 and 2FA for PyPI

#85

Post by PartiallyTyped »

a1o wrote: post #58
Uptrenda wrote: post #39

Earlier quoted context omitted.

To the guy who said the pull was horrible: IMO, the most important thing about a pull request is to... actually be productive. I've worked with people in the past who would nit-pick my commit messages wanting me to waste hours of my time trying to use arcane Git commands. Any of which might and probably will clobber my work. If you're doing Git reviews a good use of resources is to look for security problems, perform…

A good reason for enforcing some rule on git commit messages though is to have a message that helps when bisecting to find where an issue was introduced in the past. If the commit message is too meanless or too different from whatever is the convention, it makes you spend more time when tracking and solving issues.

If you’ve a test checking the regression you can use that directly to find where the regression occurred without relying on the message, no?

Re: What's up Python? Epic CPython commit, Django 5 and 2FA for PyPI

#86

Post by samus »

Uptrenda wrote: post #39
ath0 wrote: post #5

If you read nothing else, the commit message adding JIT support is worth your time: https://github.com/python/cpython/pull/113465

To the guy who said the pull was horrible: IMO, the most important thing about a pull request is to... actually be productive. I've worked with people in the past who would nit-pick my commit messages wanting me to waste hours of my time trying to use arcane Git commands. Any of which might and probably will clobber my work. If you're doing Git reviews a good use of resources is to look for security problems, perform…

`git rebase -i develop` is arcane? An editor opens where you put an 'r' in front of every commit that needs rewording. Save and close, and Git will successively open an editor for every commit message. Force Push and you're done.

If you're not willing to bother with command line: the Git client in Jetbrains also lets you edit commit messages in a very straightforward way.

Re: What's up Python? Epic CPython commit, Django 5 and 2FA for PyPI

#87

Post by eesmith »

djha-skin wrote: post #77
jurassic wrote: post #36

While I'm not against security and 2FA in general, making PyPI 2FA mandatory ahead of any kind of org support is a major pain for big projects with more than one maintainer. This week I was forced to link my company's pypi account to a personal device to unblock our latest release and now none of the dozen other maintainers I work with can get access. Things will get spicy if someone in my position were to die, leave…

You were not forced to do that because TOTP is manageable via password manager. TOTP and yubikey are excellent technologies that way. They allow two-factor authentication without breaking privacy. Everyone within the sound of my voice: get a password manager. It sounds like a hassle but it makes your life infinitely better. It allows you to keep your life private and more secure than it was while providing more conve…

I think it's odd that PyPI doesn't list any desktop programs, like KeepassXC, at https://pypi.org/help/#twofa , only mobile ones. That makes it seem like 2FA is mobile-only.

I expect some people don't want to mix work accounts on their personal phone ("keep your life private"), and because smart phones are still not yet universal, even among developers.

Re: What's up Python? Epic CPython commit, Django 5 and 2FA for PyPI

#88

Post by Kwpolska »

eesmith wrote: post #87
djha-skin wrote: post #77

Earlier quoted context omitted.

You were not forced to do that because TOTP is manageable via password manager. TOTP and yubikey are excellent technologies that way. They allow two-factor authentication without breaking privacy. Everyone within the sound of my voice: get a password manager. It sounds like a hassle but it makes your life infinitely better. It allows you to keep your life private and more secure than it was while providing more conve…

I think it's odd that PyPI doesn't list any desktop programs, like KeepassXC, at https://pypi.org/help/#twofa , only mobile ones. That makes it seem like 2FA is mobile-only. I expect some people don't want to mix work accounts on their personal phone ("keep your life private"), and because smart phones are still not yet universal, even among developers.

Many people seem to believe that keeping your 2FA keys in an un-backupable mobile app and away from your computer is safer than keeping it in your backupable and multi-device password manager.

Re: What's up Python? Epic CPython commit, Django 5 and 2FA for PyPI

#89

Post by Kwpolska »

samus wrote: post #86
Uptrenda wrote: post #39

Earlier quoted context omitted.

To the guy who said the pull was horrible: IMO, the most important thing about a pull request is to... actually be productive. I've worked with people in the past who would nit-pick my commit messages wanting me to waste hours of my time trying to use arcane Git commands. Any of which might and probably will clobber my work. If you're doing Git reviews a good use of resources is to look for security problems, perform…

`git rebase -i develop` is arcane? An editor opens where you put an 'r' in front of every commit that needs rewording. Save and close, and Git will successively open an editor for every commit message. Force Push and you're done. If you're not willing to bother with command line: the Git client in Jetbrains also lets you edit commit messages in a very straightforward way.

Force push can be scary to some. Some nitpickers may also ask you to squash/reorder/split commits to satisfy their OCD.

Re: What's up Python? Epic CPython commit, Django 5 and 2FA for PyPI

#90

Post by Kwpolska »

legends2k wrote: post #78
Uptrenda wrote: post #39

Earlier quoted context omitted.

To the guy who said the pull was horrible: IMO, the most important thing about a pull request is to... actually be productive. I've worked with people in the past who would nit-pick my commit messages wanting me to waste hours of my time trying to use arcane Git commands. Any of which might and probably will clobber my work. If you're doing Git reviews a good use of resources is to look for security problems, perform…

If someone who made the changes can't explain things clearly, I'd even wager that they didn't understand what they're changing properly. A good commit message is needed as the author might be gone but software is maintained for decades. Productivity is easy, writing a good message isn't, as the latter seems to be hard for many and it's telling of their understanding of systems they change.

Many teams will just use squash merges to avoid wasting time on commit messages and end up with just one commit to the main branch and cleaner history.
Post reply on HN