Atomicwrites' old versions have been purged from PyPI
1–10 of 75 posts
Re: Atomicwrites' old versions have been purged from PyPI
#2PyPI identifies a package as critical and asks the maintainer to enable 2FA.. but allows them to simply delete the package to get around this requirement?
Re: Atomicwrites' old versions have been purged from PyPI
#3From the GitHub README:
> PyPI wants me to enable 2FA just because I maintain this package, which I don't care for. So this package is now unmaintained.
Just set up a KeepassXC file and put your 2FA info in there? You don't need to give PyPI your phone info, PyPI takes TOTP[1]. 2FA is pretty normal; I don't see why the author has a problem with it. It doesn't violate privacy (since it's not actually tied to any PII like a phone number), it takes like 10 seconds to set up, and it protects your packages from hackers. Perhaps the author simply doesn't see the point of 2FA, since he implies the PyPI authors only did it for compliance reasons (and not for normal bolt-your-doors security reasons, which is more likely)?
He calls setting up 2FA "an expense of my free time" when surely it took more time for him to delete and re-add his package than it would have to just set up 2FA.
EDIT:
To be fair, the maintainer owes us nothing[2], sure. But it's not unreasonable to protect the larger community with basic security practices, either.
1: https://pypi.org/help/#twofa
2: https://gist.github.com/richhickey/1563cddea1002958f96e7ba95...
Re: Atomicwrites' old versions have been purged from PyPI
#4PyPI identifies a package as critical and asks the maintainer to enable 2FA.. but allows them to simply delete the package to get around this requirement?
His right
Re: Atomicwrites' old versions have been purged from PyPI
#5From the GitHub README: > PyPI wants me to enable 2FA just because I maintain this package, which I don't care for. So this package is now unmaintained. Just set up a KeepassXC file and put your 2FA info in there? You don't need to give PyPI your phone info, PyPI takes TOTP[1]. 2FA is pretty normal; I don't see why the author has a problem with it. It doesn't violate privacy (since it's not actually tied to any PII l…
Or you just maintain it?
Re: Atomicwrites' old versions have been purged from PyPI
#6From the GitHub README: > PyPI wants me to enable 2FA just because I maintain this package, which I don't care for. So this package is now unmaintained. Just set up a KeepassXC file and put your 2FA info in there? You don't need to give PyPI your phone info, PyPI takes TOTP[1]. 2FA is pretty normal; I don't see why the author has a problem with it. It doesn't violate privacy (since it's not actually tied to any PII l…
>but his response feels more so
If we keep treating open source maintainers like they owe us anything, we will have fewer open source maintainers.
Re: Atomicwrites' old versions have been purged from PyPI
#7From the GitHub README: > PyPI wants me to enable 2FA just because I maintain this package, which I don't care for. So this package is now unmaintained. Just set up a KeepassXC file and put your 2FA info in there? You don't need to give PyPI your phone info, PyPI takes TOTP[1]. 2FA is pretty normal; I don't see why the author has a problem with it. It doesn't violate privacy (since it's not actually tied to any PII l…
>but his response feels more so If we keep treating open source maintainers like they owe us anything, we will have fewer open source maintainers.
That's fair, he owes us nothing[1]; I agree with that. But it's not unreasonable to protect the larger community with basic security practices, either.
1: https://gist.github.com/richhickey/1563cddea1002958f96e7ba95...
Re: Atomicwrites' old versions have been purged from PyPI
#8From the GitHub README: > PyPI wants me to enable 2FA just because I maintain this package, which I don't care for. So this package is now unmaintained. Just set up a KeepassXC file and put your 2FA info in there? You don't need to give PyPI your phone info, PyPI takes TOTP[1]. 2FA is pretty normal; I don't see why the author has a problem with it. It doesn't violate privacy (since it's not actually tied to any PII l…
I can't blame them, I would have done the same. I assume their priorities are not aligned with pypi and have no incentive to jump through those hoops.
Re: Atomicwrites' old versions have been purged from PyPI
#9From the GitHub README: > PyPI wants me to enable 2FA just because I maintain this package, which I don't care for. So this package is now unmaintained. Just set up a KeepassXC file and put your 2FA info in there? You don't need to give PyPI your phone info, PyPI takes TOTP[1]. 2FA is pretty normal; I don't see why the author has a problem with it. It doesn't violate privacy (since it's not actually tied to any PII l…
2FA hardly adds any security if you already use password manager with long random passwords.
Re: Atomicwrites' old versions have been purged from PyPI
#10You know which modules I'm not using for my critical projects? Ones whose maintainers refuse to enable 2fa. We already know how supply chain security problems have plagued npm and pypi. Dependabot should alert you when your dependency comes from a package maintainer that doesn't use 2fa.