Re:Congratulations: We now have opinions on your open source...
by staticassertion on Saturday July 09, 2022 @04:40PM
(#32039102)
> Maybe there is none, maybe there is. The consequence however undoubtedly is that if you do not accept the terms you lose access to your package on PyPI.
Right but I just don't get why this is notable or why anyone would ever be surprised by this, or why this would ever be controversial. I just can not wrap my head around this being framed as a complex issue when it seems so very straightforward.
Re:Congratulations: We now have opinions on your open source...
by Brian_K_White on Saturday July 09, 2022 @05:24PM
(#32039449)
It is indeed so very straighforward and not a complex issue, which begs the question why you might not be able to wrap your head around it. I call volition.
The statement I made is based on what is currently communicated. The "terms" is purely "you need to use 2FA" (which just to be clear I already said I have no quarrels with). I cannot judge what will be the future requirements will be for critical packages. Donald Stufft from PyPI on Twitter said that he could imagine requiring signed releases (https://twitter.com/dstufft/status/1545503252871004161).
> I don't get the complication here.
Maybe there is none, maybe there is. The consequence however undoubtedly is that if you do not accept the terms you lose access to your package on PyPI.