PyPI Blog: Project Quarantine

Post by woodruffw » Mon, Jan 06, 2025, 7:33 PM UTC

LtWorf wrote: post #59

woodruffw wrote: post #58

Earlier quoted context omitted.

You've pointed to a stub document that basically explains Python packaging and why pip comes with Python (which, notably, distributions are fond of breaking). This doesn't somehow imply that Python has a top-down authority structure where the PSF dictates the development flow of PyPI, pip, or any other official/semi-official/blessed tooling or infrastructure. That's not how Python works as a community. The PSF is als…

I think the PSF has the means and opportunity to say "please don't use xxx, use yyy instead". Which is why conda and linux distributions are not seen on the same footing at all.

I think it's more because Conda has explicitly positioned itself for a specific domain (scientific Python) and because Linux distributions aren't operating at the same level of specificity. The success of uv has demonstrated that Python packaging tools don't need PSF or PyPA affiliation to be extremely popular; they just have to be good.

But this final claim is essentially right: PSF can suggest things, and the community will (to some extent) accept those suggestions as blessed. But this doesn't mean that the PSF can dictate what would essentially be a significant breaking change to pip's behavior.

Post by toomuchtodo » Mon, Jan 06, 2025, 9:05 PM UTC

intelVISA wrote: post #9

toomuchtodo wrote: post #4

Earlier quoted context omitted.

One of my responsibilities is software supply chain security in a financial services org, so this signal would be valuable for vulnerability management of dependencies. I wouldn't call it "threat hunting" per se, but ground truth around threat actor patterns helps us build better defensive systems in this regard. Keeping the bad bits out is way easier than remediating once they've been ingested into systems. > Your c…

That sounds quite daunting, Python and supply chain security are almost at odds with each other these days. Lowkey surprised that any well-resourced org would use it given the outsized risk profile and poor performance.

It’s not used in the core or for anything load bearing, but has some ancillary uses, and we strive for total coverage (as much as practical). If we use something, we want to secure it as best we can.

Re: PyPI Blog: Project Quarantine

Re: PyPI Blog: Project Quarantine