miketheman

The infrastructure sponsors can be found in the PyPI footer, and here: https://pypi.org/sponsors/#:~:text=Infrastructure%20sponsors

Whoops, sorry about that. Should be fixed now. Happy New Year!

PyPI responses are cached at 99% or higher, with less infrastructure to run.

Search is an unbounded context and does not lend itself to caching very well, as every search can contain anything

Kudos to the maintainers taking on the hard parts of security, especially since we paid $0 for all of their hard work. Thank you, Mike, Patrick, William, and all the others!

Alpha Omega is proud to share the newly published white paper from Seth Larson of the Python Software Foundation, titled “Slippery Zips and Sticky Tar Pits: Security and Archives.” Seth serves as Python’s Security Developer in Residence, a role sponsored by Alpha Omega, focused on improving the safety and trustworthiness of open source software that powers systems and applications everywhere.

Incident report of a recent attack campaign targeting GitHub Actions workflows to exfiltrate PyPI tokens, our response, and steps to protect your projects.

This largely depends on the ICANN policies and their definitions of Renewal and Registration Grace Periods. The Renewal period is variable, but the Registration Grace Period is pretty much 30 days everywhere.

https://www.icann.org/en/contracted-parties/consensus-polici...

Here's an example from denic.de: https://www.denic.de/en/domains/de-domains/domain-deletion#c...

PyPI now checks for expired domains to prevent domain resurrection attacks, a type of supply-chain attack where someone buys an expired domain and uses it to take over PyPI accounts through password resets.

There is an active phishing attack targeting PyPI users.

• Threat: Emails from [email protected] (with a 'j') link to a fake login page.

• Action: Do not click any links. If you already did, change your PyPI password ASAP.

• Note: PyPI itself has not been breached.

Sadly the majority of this data is not externally visible.

Thank you!