Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Atomicwrites' old versions have been purged from PyPI

github.com

Post reply on HN
Print view View original

11–20 of 75 posts

Re: Atomicwrites' old versions have been purged from PyPI

#11

Post by ary »

bvrmn wrote: post #9
djhaskin987 wrote: post #3

From the GitHub README: > PyPI wants me to enable 2FA just because I maintain this package, which I don't care for. So this package is now unmaintained. Just set up a KeepassXC file and put your 2FA info in there? You don't need to give PyPI your phone info, PyPI takes TOTP[1]. 2FA is pretty normal; I don't see why the author has a problem with it. It doesn't violate privacy (since it's not actually tied to any PII l…

2FA hardly adds any security if you already use password manager with long random passwords.

This is clearly not true. Having a second factor helps maintain security in the situation where your password is compromised (phishing is just one scenario). It isn't perfect, and can itself be defeated. However, compromising an account with 2FA is demonstrably more difficult than one without.

Re: Atomicwrites' old versions have been purged from PyPI

#12

Post by krasin »

djhaskin987 wrote: post #7
krasin wrote: post #6

Earlier quoted context omitted.

>but his response feels more so If we keep treating open source maintainers like they owe us anything, we will have fewer open source maintainers.

That's fair, he owes us nothing[1]; I agree with that. But it's not unreasonable to protect the larger community with basic security practices, either. 1: https://gist.github.com/richhickey/1563cddea1002958f96e7ba95...

I am not objecting the 2FA deployment - it's a good idea. I am objecting the attitude towards maintainers which disagree - they have the right to disagree. They owe us nothing.

Re: Atomicwrites' old versions have been purged from PyPI

#13

Post by ary »

This is a bizarrely emotional response to me. PyPI offered to provide a security key to make the maintainer's life easier so it's hard to see this as an "entitled" act. When I see the core infrastructure for open source software ecosystems improve I cheer that effort on.

While I am in full support of not asking too much of open source maintainers a cooperative stance makes the overall situation better for everyone involved. This could have been handled in a better way.

Re: Atomicwrites' old versions have been purged from PyPI

#14

Post by Wowfunhappy »

jamesboehmer wrote: post #10

You know which modules I'm not using for my critical projects? Ones whose maintainers refuse to enable 2fa. We already know how supply chain security problems have plagued npm and pypi. Dependabot should alert you when your dependency comes from a package maintainer that doesn't use 2fa.

That's entirely reasonable. However, it is also reasonable for the author, who is working for free, to ignore your concerns.

Re: Atomicwrites' old versions have been purged from PyPI

#15

Post by Wowfunhappy »

ary wrote: post #11
bvrmn wrote: post #9

Earlier quoted context omitted.

2FA hardly adds any security if you already use password manager with long random passwords.

This is clearly not true. Having a second factor helps maintain security in the situation where your password is compromised (phishing is just one scenario). It isn't perfect , and can itself be defeated. However, compromising an account with 2FA is demonstrably more difficult than one without.

If they can phish my password, they can trivially phish my OTP as well. The one thing I can see actually protecting against that is a physical hardware key, but that's a lot of extra inconvenience.

Re: Atomicwrites' old versions have been purged from PyPI

#16

Post by yongjik »

krasin wrote: post #6
djhaskin987 wrote: post #3

From the GitHub README: > PyPI wants me to enable 2FA just because I maintain this package, which I don't care for. So this package is now unmaintained. Just set up a KeepassXC file and put your 2FA info in there? You don't need to give PyPI your phone info, PyPI takes TOTP[1]. 2FA is pretty normal; I don't see why the author has a problem with it. It doesn't violate privacy (since it's not actually tied to any PII l…

>but his response feels more so If we keep treating open source maintainers like they owe us anything, we will have fewer open source maintainers.

We can say the same thing about maintainers of PyPI. They host your libraries and serve it to anyone who wants, free of charge. The only thing they ask in return is to maintain a minimum level of security so that they have less headache in the future.

I think they also deserve some respect.

Re: Atomicwrites' old versions have been purged from PyPI

#17

Post by dmart »

jbverschoor wrote: post #4
afturner wrote: post #2

PyPI identifies a package as critical and asks the maintainer to enable 2FA.. but allows them to simply delete the package to get around this requirement?

His right

I dunno, I think if you publish a copy of your code to a registry then it would be both desirable and reasonable for that copy to be immutable. Allowing the deletion of published libraries can have huge downstream impacts and ultimately makes the registry less trustworthy.

Edit: to be clear, not trying to shame the author here - it sounds like they tried to avoid this situation: "what i didn't consider is that this would delete old versions. those are apparently now gone and yet it's apparently not possible for me to re-upload them. i don't think that's sensible behavior by pypi, but either way i'm sorry about that."

I think this is a bad design on PyPI's part though.

Re: Atomicwrites' old versions have been purged from PyPI

#19

Post by krasin »

yongjik wrote: post #16
krasin wrote: post #6

Earlier quoted context omitted.

>but his response feels more so If we keep treating open source maintainers like they owe us anything, we will have fewer open source maintainers.

We can say the same thing about maintainers of PyPI. They host your libraries and serve it to anyone who wants, free of charge. The only thing they ask in return is to maintain a minimum level of security so that they have less headache in the future. I think they also deserve some respect.

Yep. Both parties here are within their rights. It's the HN comment about entitlement of the maintainer that I was responding to.

Re: Atomicwrites' old versions have been purged from PyPI

#20

Post by Wowfunhappy »

ary wrote: post #13

This is a bizarrely emotional response to me. PyPI offered to provide a security key to make the maintainer's life easier so it's hard to see this as an "entitled" act. When I see the core infrastructure for open source software ecosystems improve I cheer that effort on. While I am in full support of not asking too much of open source maintainers a cooperative stance makes the overall situation better for everyone in…

> PyPI offered to provide a security key to make the maintainer's life easier

It's even easier to just leave 2FA disabled and stop maintaining the project. Which is what they did.

Are maintainers obligated to support their projects indefinitely?

Post reply on HN