51 points rbanffy 1 hour ago 7 comments
abcmall 35 minutes ago | parent
Always the same. After a submission with a backlash, two days later people try to polish Python's image.
Too late.
tdeck 25 minutes ago | parent
Two days seems like a decent response time to make an improvement, no?
jlak-aski 20 minutes ago | parent
No, the backlash was in Tim Peter's obituary, not in a PyPI thread. No improvement can be made apart from firing all people involved in libel and harassment of dissenters.
This is just the usual diversion that magically floated right to the top.
abbadadda 16 minutes ago | parent
What’s the story? I seem to have missed this.
cowlevel 30 minutes ago | parent
This is about detecting formerly benign projects that have had their pypi entries hacked, but not their private keys. It does not detect malicious projects.
djoldman 15 minutes ago | parent
Some examples:
dlt (no provenance): https://pypi.org/project/dlt/#files
datasette (yes provenance): https://pypi.org/project/datasette/#files
mistursinistur 5 minutes ago | parent
Nobody is looking at these pages