Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What's up Python? Epic CPython commit, Django 5 and 2FA for PyPI

bitecode.dev

Post reply on HN
Print view View original

121–123 of 123 posts

Re: What's up Python? Epic CPython commit, Django 5 and 2FA for PyPI

#121

Post by grumpyprole »

pandaxtc wrote: post #67
grumpyprole wrote: post #57

Earlier quoted context omitted.

That only works with a few built in types, like numbers. For any other type, you had better hope that the author has added such checks.

This isn't true, even if you define your own types/classes you still can't add them together willy nilly unless you (or a superclass) explicitly defined an addition operator. The Python language itself will never implicitly coerce a type for you, not even for floating point and integer addition. [0] [0] https://www.pythonmorsels.com/type-coercion/

I was speaking generally not specifically about addition. If you create new types and especially new operations on those types, then it will be up to you to add runtime "type checks" to avoid other failures. Try defining equality for a Point class for an example.

Re: What's up Python? Epic CPython commit, Django 5 and 2FA for PyPI

#122

Post by LtWorf »

woodruffw wrote: post #115
LtWorf wrote: post #84

Earlier quoted context omitted.

To create a new package, you MUST generate a global token that can also do whatever on all existing packages on the account. How many people do you think will bother to delete the global token after having used it, and then generate a scoped one? 1%? Probably much less than that.

You can create a new package via a "pending publisher"[1], which does not require a user-scoped token. (Note: even though PyPI calls them "user-scoped tokens," they have less access than a password does, since they can't manage the user's account itself. So, while not ideal, they are still a better choice than a user/pass combination.) [1]: https://docs.pypi.org/trusted-publishers/creating-a-project-...

Oh they've listened to me at least.

Re: What's up Python? Epic CPython commit, Django 5 and 2FA for PyPI

#123

Post by perlgeek »

ptx wrote: post #37
perlgeek wrote: post #14

The deprecation of "crypt" could have been handled a bit better, IMHO. It recommends to use "hashlib" instead, which isn't API compatible to crypt, and if you load it on a new enough python... triggers a deprecation warning about "crypt" being deprecated. Oh, and it seems unmaintained.

Did you mean "passlib", the third-party module they link to? The built-in "hashlib" doesn't generate any warnings for me on Python 3.11 and is presumably maintained as part of Python. Anyway, the PEP mentions that "crypt" is not secure, not thread-safe, not cross-platform and not useful for modifying the system password database... so it sounds like you really shouldn't use it for much of anything. What's your usecas…

Yes, passlib, sorry for the confusion.

> What's your usecase?

We need to store hashed passwords that are then used by third-party programs (like Apache or exim) to authenticate users, so we need to generate salts and hashes in formats compatible to them.

It works with passlib after some fiddling, it was just way more fiddly than I'd expect from python.

Post reply on HN