Top
Best
New

Posted by rbanffy 7 hours ago

PyPI's redesigned project pages with clearer security signals are now live(blog.pypi.org)
180 points | 82 commentspage 2
jothimani 4 hours ago|
[flagged]
zxc0827 6 hours ago||
[flagged]
LdBaringSwallow 5 hours ago||
> https://blog.pypi.org/posts/2024-11-14-pypi-now-supports-dig...

Thought we already learned years ago an IP address is not a person?

That is to say; what the screen on my end communicates is not guaranteed to be representative of ground truth.

The IT world was recently making fun of Sam Altman's eye scanner because remote attestation can be faked.

All the layers of abstraction wrapped around the code is security through obscurity.

The code itself must still be verified as safe.

The cloud era has resulted in a lot of people operating at layers of abstraction so far removed from physics this shit has more in common with baseless dogmas, gospels, and spiritualities at this point.

We anthropomorphized the cloud inserting ourselves into it. It's just a bunch of networked computers.

All this stuff is a spoon that doesn't exist.

bonoboTP 4 hours ago|
You're speaking in such shorthand that I have no idea how to untangle what you're actually trying to say/propose. I suppose you're saying that attested code can still be malware because malicious actors can also go through the attestation process?
rcxdude 4 hours ago||
Yeah, this check basically just proves that you hosted your source code on a big platform and then built the pypi package with their CI. This is not particularly strong as a trust signal. Especially since it doesn't particularly protect against compromise of access to the code repository. I worry that this is going to distract from better approaches (like reproducable builds and/or distributed review).
mistursinistur 6 hours ago||
Nobody is looking at these pages
tzlahp 5 hours ago|
True, therefore downvoted.
abcmall 6 hours ago|
[flagged]
tdeck 6 hours ago||
Two days seems like a decent response time to make an improvement, no?
jlak-aski 6 hours ago||
[flagged]
abbadadda 6 hours ago||
What’s the story? I seem to have missed this.
neuronexmachina 6 hours ago|||
Yeah, I have no idea what they're talking about either.
Kwpolska 5 hours ago|||
https://chrismcdonough.substack.com/p/the-shameful-defenestr...
akerl_ 3 hours ago||
The drama here is that 2 years ago, a Python core dev was suspended for 3 months as part of a mailing list fight?
aftbit 2 hours ago||
I'm also out of the loop, but from my reading, I guess some people didn't like Tim Peters and his positions on some culture war stuff, and didn't like that people were generally focusing on his positive contributions to the project right after his death, rather than his views on race or whatever.
akerl_ 1 hour ago||
Oh, that's even weirder. So the drama was that people were saying nice things about somebody who had just passed?

Then I'm more confused than before about why the original commenter on this branch would suggest this security feature release is a "diversion". A diversion from what? The fact that people weren't talking about something?