Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Atomicwrites' old versions have been purged from PyPI

github.com

Post reply on HN
Print view View original

71–75 of 75 posts

Re: Atomicwrites' old versions have been purged from PyPI

#71

Post by staticassertion »

Wowfunhappy wrote: post #65
staticassertion wrote: post #64

Earlier quoted context omitted.

So make a proposal for them to do that.

Okay, this is me proposing it! :) I'm not the first person to come up with this idea. I think if PyPI had taken the approach of "here are our concerns, here is what we're protecting, here are some different options to make this work in the most convenient way possible", that would have been received very differently. Instead, they issued an ultimatum.

I think you'll find that in the course of making an actual formal proposal there are more caveats than you might imagine, and not necessarily as many upsides.

For example, just off the top of my head;

2FA as a general solution allows for U2F, which is significantly safer than your solution, even if it also allows for TOTP, which is "only" as safe as your solution.

It's also a change in user experience. Migrating users with existing passwords over to these new passwords may be more difficult for any number of reasons.

That's just a few seconds of thought. A real proposal might explicitly address these concerns. Like I said, feel free to make that proposal. A post on HN is not going to cut it, and it isn't going to help anyone. If you want to be more involved in how PyPI is maintained I suggest you do so.

Re: Atomicwrites' old versions have been purged from PyPI

#72

Post by pyuser583 »

tsimionescu wrote: post #66
pyuser583 wrote: post #62

Earlier quoted context omitted.

Not quite. When a package is submitted to PyPi, there’s legalese that says people can download and use it. > If I upload Content other than under an Included License, then I grant the PSF and all other users of the web site an irrevocable, worldwide, royalty-free, nonexclusive license to reproduce, distribute, transmit, display, perform, and publish the Content, including in digital form. https://pypi.org/policy/term…

The paragraph following that one is more important in this context: > For the avoidance of doubt, my warranty or license as set forth above applies to the Content exactly in the form provided to the PSF, and does not, other than as may be provided in the Included License, grant the PSF or any users of the website a license to make or distribute derivative works based on my Content. So yes, you have a right to downloa…

Having a specific license, and not depending on a platforms default legalese is absolutely a best practice.

This package was installed by a novice programmer. It’s archaic (pre-git, pre-Python-2.5) and has no business being used by anyone, anywhere, for anything.

Re: Atomicwrites' old versions have been purged from PyPI

#73

Post by whizzter »

daedalus2027 wrote: post #36
whizzter wrote: post #33

Earlier quoted context omitted.

I wonder how people who maintain CI pipelines feels about it on monday if they're recalled from vacations because the pipelines broke.

they are being paid for being recalled from vacations while this developer is doing it for free... that was his point...

Oh I agree, my point was rather that the haphazard way of handling this by the PyPi folks.

Re: Atomicwrites' old versions have been purged from PyPI

#74

Post by Wowfunhappy »

eternityforest wrote: post #70
adastra22 wrote: post #69

Earlier quoted context omitted.

I have ADHD. I lose things. I once had to restore access to a 2FA protected account I’d lost the token to. It took weeks of back-and-forth and involved sending personal information (selfies with identity cards) the service had no business knowing. Never again. Especially for an unpaid personal project for which I owe nobody anything. If PyPI sent me this email, I’d immediately nuke all versions of all packages I main…

I lose things incredibly often too(Like, losing my wallet twice and keys once, all within a 12 month period, going inside and leaving keys in the front door, needing GPS to get home 3 blocks away, etc). If 2FA was token based as people seem to want it to be, I'd have an issue, but SMS based is enough to keep out the majority of opportunistic attackers while being recoverable. Plus, there's always printable recovery c…

> If 2FA was token based as people seem to want it to be, I'd have an issue, but SMS based is enough to keep out the majority of opportunistic attackers while being recoverable.

But so is using a long, unique, random password stored in a password manager! In fact, a strong password is more secure because it's not vulnerable to SIM swapping.

Admittedly, you could use both, but many/most services will let you use SMS for password recovery once it's set up, so it ends up becoming a single factor!

I'm also really nervous about loosing access to my phone number some day due to some screwup or other.

> Plus, there's always printable recovery codes with Google at least.

But I loose things. Especially slips of paper which I usually don't need to access. There is absolutely no way in hell I will be able to find a printout of backup codes when I actually need them.

Re: Atomicwrites' old versions have been purged from PyPI

#75

Post by mwarkentin »

afturner wrote: post #2

PyPI identifies a package as critical and asks the maintainer to enable 2FA.. but allows them to simply delete the package to get around this requirement?

Apparently when the 2fa requirement is actually implemented (this was just an announcement which triggered this) deleting a package would require 2fa as well.

Other registries go further and make it harder or impossible to delete once certain criteria are met (pretty sure this was put in place after leftpad broke the whole ecosystem): https://docs.npmjs.com/unpublishing-packages-from-the-regist...

Post reply on HN