It's a completely reasonable reading of their message to assume that the “possible” in “whenever possible” roughly means “legal”. I don't think any reasonable reading of it means to imply that they are willing to violate federal law.
Re:PyPI Was Subpoenaed
by avgcorrection on Wednesday May 24, 2023 @02:10PM
(#36061943)
Fair point.
Re:PyPI Was Subpoenaed
by Mystery-Machine on Wednesday May 24, 2023 @02:18PM
(#36062043)
Oke way to protect user data is to NOT ask/collect data in the first place. What's the need of person's full name and address for? Maybe I'm missing the point, but I see zero reasons to have this data in the first place.
Re:PyPI Was Subpoenaed
by avgcorrection on Wednesday May 24, 2023 @02:22PM
(#36062092)
That’s the best principle to follow. Agreed.
You are probably reading what data the DoJ requested.
Further down in the blogpost (in the "Details" section) they state that they don't have a lot of the data requested and exactly what kind of data they could and did provide. Addresses are not requested by PyPI.
And they state very clearly they don't have this information. In fact, PyPi seems to retain a very reasonable set of information, strictly related to the service itself. I found this disclosure to be entirely refreshing.
If you read the whole thing, it's pretty clear they don't have the person's full name and address, and thus did not provide it. They do mention that it will be needed for organizations that sign up for billing when that feature becomes available.
Other than possibly IP addresses, it seems like the only information they had available to disclose was close to the bare minimum needed to operate the service.
Re:PyPI Was Subpoenaed
by HelloNurse on Wednesday May 24, 2023 @03:34PM
(#36062933)
sudo give us user data
Lighten up. Nobody's going to federal court to stop the DOJ from investigating botnets, carding rings, and ransomware scams, which is what these things are usually about. Nobody's mental model of PyPI was that they had Signal's priorities.
Re:PyPI Was Subpoenaed
by avgcorrection on Wednesday May 24, 2023 @02:10PM
(#36061937)
Then all the less reason to roll out the “of utmost importance” boilerplate. So what’s your point?
Also I don’t see how being light-hearted has anything to do with this submission, Thomas.
Re:PyPI Was Subpoenaed
by davidguetta on Wednesday May 24, 2023 @04:02PM
(#36063212)
Its just they have no choice. And when they do the choose their "utmost priority". Its not that complicated
Re:PyPI Was Subpoenaed
by mrguyorama on Wednesday May 24, 2023 @02:12PM
(#36061969)
Then they shouldn't say protecting their users are their top priority, because they have shown it is not. That's called lying. A correct statement would have been "we will comply with lawful LEO requests"
Helping convict scammers, typo-squatters injecting malicious code, etc is protecting their users. Just not the (likely) bad actors that are the subject of the subpoenas.
The fact remains, that unless you are willing to break the law, obeying the law is your top priority.
If you're so inclined, you're welcome to make an anarcho-oriented package management system yourself. PyPi has never claimed to be one, though.
This assumes that all of this is binary, when in reality it’s a complex system that takes time and effort to modify in a meaningful and responsible way.
How have they shown it's not, exactly? Really curious what you think they could have done better aside from blatantly going against laws in their jurisdiction.
There's a difference between abiding by lawful court orders that have gone through judicial process and a friend in a police department calling in a favour.
I don’t see anything conflicting in what they said.
They can feel that way, and comply.
Re:PyPI Was Subpoenaed
by avgcorrection on Wednesday May 24, 2023 @04:22PM
(#36063406)
Yeah. I was probably being a little too boilerplate (what looked like) -intolerant. ;)
Don’t lead with this.
> In this case, however, PSF determined with the advice of counsel that our only course of action was to provide the requested data.
If you’re going to say this.
I’m not judging their decision. Maybe not going to prison is a greater concern to them. It’s fine to just say that you thought it was best to comply because [lawyer reasons that you don’t have to disclose to anyone]/counsel.
EDIT: Or say “there are bad people out there and we trust the DOJ”. Whatever.