Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Atomicwrites' old versions have been purged from PyPI

github.com

Post reply on HN
Print view View original

31–40 of 75 posts

Re: Atomicwrites' old versions have been purged from PyPI

#31

Post by staticassertion »

naniwaduni wrote: post #26
ary wrote: post #11

Earlier quoted context omitted.

This is clearly not true. Having a second factor helps maintain security in the situation where your password is compromised (phishing is just one scenario). It isn't perfect , and can itself be defeated. However, compromising an account with 2FA is demonstrably more difficult than one without.

While there are scenarios where 2FA can maintain security where a password is compromised, it's absolutely true that for a large swath of practical threat models, almost the entire benefit of 2FA comes in the form of assigning the shared secret instead of letting the user pick a weak and/or widely-reused password and the "having a second factor" bit doesn't really factor into the picture in any meaningful way.

These weaknesses are implementation specific. FIDO2/U2F is unphishable, requires proof of presence, and is a significant security win over a strong password.

Re: Atomicwrites' old versions have been purged from PyPI

#32

Post by savant_penguin »

ary wrote: post #13

This is a bizarrely emotional response to me. PyPI offered to provide a security key to make the maintainer's life easier so it's hard to see this as an "entitled" act. When I see the core infrastructure for open source software ecosystems improve I cheer that effort on. While I am in full support of not asking too much of open source maintainers a cooperative stance makes the overall situation better for everyone in…

Maybe some people use their side projects to develop software without the bureaucratic crap full time jobs have. And any amount of bureaucracy is too much for his free side project

Re: Atomicwrites' old versions have been purged from PyPI

#33

Post by whizzter »

staticassertion wrote: post #27
AngusH wrote: post #21

The whole package has now been deprecated by the maintainer: 'PyPI wants me to enable 2FA just because I maintain this package, and both that and the mess resulting from a stunt of mine, I thought it'd be a good time to deprecate this package. Python 3 has os.replace and os.rename which probably do well enough of a job for most usecases.' https://github.com/untitaker/python-atomicwrites Edit: From the bug report 'I d…

That sounds like a best of both worlds. PyPI sets a minimum bar for developer responsibility and you can opt out of publishing to PyPI if you don't want to be that responsible. The system works.

I wonder how people who maintain CI pipelines feels about it on monday if they're recalled from vacations because the pipelines broke.

Re: Atomicwrites' old versions have been purged from PyPI

#34

Post by staticassertion »

savant_penguin wrote: post #32
ary wrote: post #13

This is a bizarrely emotional response to me. PyPI offered to provide a security key to make the maintainer's life easier so it's hard to see this as an "entitled" act. When I see the core infrastructure for open source software ecosystems improve I cheer that effort on. While I am in full support of not asking too much of open source maintainers a cooperative stance makes the overall situation better for everyone in…

Maybe some people use their side projects to develop software without the bureaucratic crap full time jobs have. And any amount of bureaucracy is too much for his free side project

So why publish to PyPI? I have tons of personal projects that never leave my laptop, or, at most, github.

Re: Atomicwrites' old versions have been purged from PyPI

#35

Post by Wowfunhappy »

staticassertion wrote: post #31
naniwaduni wrote: post #26

Earlier quoted context omitted.

While there are scenarios where 2FA can maintain security where a password is compromised, it's absolutely true that for a large swath of practical threat models, almost the entire benefit of 2FA comes in the form of assigning the shared secret instead of letting the user pick a weak and/or widely-reused password and the "having a second factor" bit doesn't really factor into the picture in any meaningful way.

These weaknesses are implementation specific. FIDO2/U2F is unphishable, requires proof of presence, and is a significant security win over a strong password.

Is PyPI requiring maintainers to use a hardware key? If not, I don’t understand how this policy is helpful.

Anyone who hadn’t already turned on 2FA is going to use the most frictionless so-called second factor they can.

Re: Atomicwrites' old versions have been purged from PyPI

#36

Post by daedalus2027 »

whizzter wrote: post #33
staticassertion wrote: post #27

Earlier quoted context omitted.

That sounds like a best of both worlds. PyPI sets a minimum bar for developer responsibility and you can opt out of publishing to PyPI if you don't want to be that responsible. The system works.

I wonder how people who maintain CI pipelines feels about it on monday if they're recalled from vacations because the pipelines broke.

they are being paid for being recalled from vacations while this developer is doing it for free... that was his point...

Re: Atomicwrites' old versions have been purged from PyPI

#37

Post by [deleted] »

staticassertion wrote: post #34
savant_penguin wrote: post #32

Earlier quoted context omitted.

Maybe some people use their side projects to develop software without the bureaucratic crap full time jobs have. And any amount of bureaucracy is too much for his free side project

So why publish to PyPI? I have tons of personal projects that never leave my laptop, or, at most, github.

[deleted]

Re: Atomicwrites' old versions have been purged from PyPI

#38

Post by eternityforest »

Wowfunhappy wrote: post #14
jamesboehmer wrote: post #10

You know which modules I'm not using for my critical projects? Ones whose maintainers refuse to enable 2fa. We already know how supply chain security problems have plagued npm and pypi. Dependabot should alert you when your dependency comes from a package maintainer that doesn't use 2fa.

That's entirely reasonable. However, it is also reasonable for the author, who is working for free, to ignore your concerns.

I think it's completely insane to not use 2FA when available... but I also support the freedom to not maintain a piece of software unpaid. One person projects are pretty miserable.

Re: Atomicwrites' old versions have been purged from PyPI

#39

Post by pyuser583 »

Wowfunhappy wrote: post #20
ary wrote: post #13

This is a bizarrely emotional response to me. PyPI offered to provide a security key to make the maintainer's life easier so it's hard to see this as an "entitled" act. When I see the core infrastructure for open source software ecosystems improve I cheer that effort on. While I am in full support of not asking too much of open source maintainers a cooperative stance makes the overall situation better for everyone in…

> PyPI offered to provide a security key to make the maintainer's life easier It's even easier to just leave 2FA disabled and stop maintaining the project. Which is what they did. Are maintainers obligated to support their projects indefinitely?

There’s a moral obligation to mitigate harm caused by your project.

I recently ran into a situation where a very old package caused terrible damage.

I contacted the pypi maintainer. He apologized and promised to fix it. Six months later, no changes.

This was a very unusual situation, as the package was the same name as a module later adopted in the standard library.

The author was under the impression the package was literally uninstallable since the code hadn’t been valid Python for over two decades, including the setup script.

Still wish they would delete it.

Re: Atomicwrites' old versions have been purged from PyPI

#40

Post by mwt »

pyuser583 wrote: post #39
Wowfunhappy wrote: post #20

Earlier quoted context omitted.

> PyPI offered to provide a security key to make the maintainer's life easier It's even easier to just leave 2FA disabled and stop maintaining the project. Which is what they did. Are maintainers obligated to support their projects indefinitely?

There’s a moral obligation to mitigate harm caused by your project. I recently ran into a situation where a very old package caused terrible damage. I contacted the pypi maintainer. He apologized and promised to fix it. Six months later, no changes. This was a very unusual situation, as the package was the same name as a module later adopted in the standard library. The author was under the impression the package was…

What was the license of this package?
Post reply on HN