Atomicwrites' old versions have been purged from PyPI

Post by pyuser583 » Sat, Jul 09, 2022, 4:54 AM UTC

mwt wrote: post #40

pyuser583 wrote: post #39

Earlier quoted context omitted.

There’s a moral obligation to mitigate harm caused by your project. I recently ran into a situation where a very old package caused terrible damage. I contacted the pypi maintainer. He apologized and promised to fix it. Six months later, no changes. This was a very unusual situation, as the package was the same name as a module later adopted in the standard library. The author was under the impression the package was…

What was the license of this package?

Post by jbverschoor » Sat, Jul 09, 2022, 6:34 AM UTC

Wowfunhappy wrote: post #24

dmart wrote: post #17

Earlier quoted context omitted.

I dunno, I think if you publish a copy of your code to a registry then it would be both desirable and reasonable for that copy to be immutable. Allowing the deletion of published libraries can have huge downstream impacts and ultimately makes the registry less trustworthy. Edit: to be clear, not trying to shame the author here - it sounds like they tried to avoid this situation: "what i didn't consider is that this w…

I agree. The logic is similar to why you can't delete an HN comment once someone replies.

Post by Wowfunhappy » Sat, Jul 09, 2022, 10:46 AM UTC

staticassertion wrote: post #44

Wowfunhappy wrote: post #35

Earlier quoted context omitted.

Is PyPI requiring maintainers to use a hardware key? If not, I don’t understand how this policy is helpful. Anyone who hadn’t already turned on 2FA is going to use the most frictionless so-called second factor they can.

They've been offering people hardware keys for free. https://pypi.org/security-key-giveaway/

Post by staticassertion » Sat, Jul 09, 2022, 1:45 PM UTC

Wowfunhappy wrote: post #45

staticassertion wrote: post #44

Earlier quoted context omitted.

They've been offering people hardware keys for free. https://pypi.org/security-key-giveaway/

That's a great initiative, but I expect the maintainers who are interested to be the ones who've already turned on (some lesser form of) 2FA voluntarily. Anyone who is turning on 2FA because of this requirement is going to select the most frictionless method of complying with the mandate. Which will not be a hardware key.

Post by [deleted] » Sat, Jul 09, 2022, 6:50 PM UTC

pyuser583 wrote: post #39

Wowfunhappy wrote: post #20

Earlier quoted context omitted.

> PyPI offered to provide a security key to make the maintainer's life easier It's even easier to just leave 2FA disabled and stop maintaining the project. Which is what they did. Are maintainers obligated to support their projects indefinitely?

There’s a moral obligation to mitigate harm caused by your project. I recently ran into a situation where a very old package caused terrible damage. I contacted the pypi maintainer. He apologized and promised to fix it. Six months later, no changes. This was a very unusual situation, as the package was the same name as a module later adopted in the standard library. The author was under the impression the package was…