47 points rbanffy 1 hour ago 7 comments
abcmall 30 minutes ago | parent
Always the same. After a submission with a backlash, two days later people try to polish Python's image.
Too late.
tdeck 21 minutes ago | parent
Two days seems like a decent response time to make an improvement, no?
jlak-aski 16 minutes ago | parent
No, the backlash was in Tim Peter's obituary, not in a PyPI thread. No improvement can be made apart from firing all people involved in libel and harassment of dissenters.
This is just the usual diversion that magically floated right to the top.
abbadadda 12 minutes ago | parent
What’s the story? I seem to have missed this.
cowlevel 26 minutes ago | parent
This is about detecting formerly benign projects that have had their pypi entries hacked, but not their private keys. It does not detect malicious projects.
djoldman 10 minutes ago | parent
Some examples:
dlt (no provenance): https://pypi.org/project/dlt/#files
datasette (yes provenance): https://pypi.org/project/datasette/#files