ewdurbin
Re:PyPI Was Subpoenaed
on Thursday May 25, 2023 @04:32PM (#36075807)
I took a report down within 3 minutes of upload today. We have regularly received comments from our 3rd-party reporters that we are the most responsive.
You are wrong.
Re:PyPI Was Subpoenaed
on Wednesday May 24, 2023 @08:33PM (#36065787)
This assumes that all of this is binary, when in reality it’s a complex system that takes time and effort to modify in a meaningful and responsible way.
Re:PyPI Was Subpoenaed
on Wednesday May 24, 2023 @06:52PM (#36064872)
no. they wanted the downloads by randoms. we don’t store those with IPs
Re:PGP signatures on PyPI: worse than useless
on Sunday May 21, 2023 @01:15PM (#36022938)
Python release files have been signed with sigstore for the last couple versions. You can peruse the release tooling that uses it at https://github.com/python/release-tools
Re:PyPI new user and new project registrations temporarily suspended
on Saturday May 20, 2023 @04:35PM (#36015347)
there are no plans to limit trusted publishers. in fact there is another in the works: https://github.com/pypi/warehouse/issues/13551