Re:3500 packages uploaded to PyPI, pointing to a malicious URL
by tantalor on Tuesday March 02, 2021 @11:01AM
(#26316671)
You misunderstand me. I don't think every single code contributor needs to divulge their identity. Only the package owner (one person) needs to vouch for the code in the package by putting their name on it. That person may have written none of the code, but they should be accountable for it. This is similar to how websites have domain owners.
[ Parent
| on HN ]
Re:3500 packages uploaded to PyPI, pointing to a malicious URL
by ajarmst on Tuesday March 02, 2021 @12:27PM
(#26317771)
I think you'll find the set of people simultaneously competent to maintain a python package and willing to take on potentially significant legal liability for free is too small to maintain a software ecosystem. This isn't necessarily bad: it means that the process of evaluating and securing code has tangible value and provides incentive to hire programmers or their consulting companies, which improves my odds of being able to feed my children in the future.
Re:3500 packages uploaded to PyPI, pointing to a malicious URL
by dgjdfhsdfh on Tuesday March 02, 2021 @11:14AM
(#26316834)
So you can sue them should their account get taken over or for other reasons? Or so that people can harass maintainers they do not like easier?
Looks like unneeded legal risks with no reward given people can already reveal their name if they want to.