Python's PyPi Package Repository Temporarily Halted New Signups, Citing 'Volume...

Python's PyPi Package Repository Temporarily Halted New Signups, Citing 'Volume of Malicious Projects'

›

• You've clearly not worked in projects with many dependencies and each dependency having their own set of dependencies. Git submodules requires you to manage everything of every other submodule by hand. How do you deal with vulnerabilities within specific versions? What about conflicts between 2 projects? Submodules was never intended for what you use it.

  • Re:

    Sounds like a terrible design.

    • Re: Git Submodules

      More like don't reinvent the wheel, sure you can write it all yourself, and if you are working inside a massive multinational or high security/risk environment you probably should, but go tell a client that the software he wants cost 10x more, lets see how many projects you'll be allowed to build.

  • Re:

    The whole system is a mess. It's like people have never heard of a stable API. Public repos are rarely policed properly either, both for malware and for automated testing. It wouldn't be hard to have PyPi require a decent test suite and builds that pass it, especially for popular projects where breakage will cause a lot of problems.

• Re:

  Having a broad variety of open source tools, some of which are _the_ reference tool, is useful. It happened with Perl, and Java, and is being tried with flatpacks and golang and tust. There are problems: ridiculous chains of unreliable and unpredictably incompatible dependencies are one of the risks we've seen with all of these packaging systems. Each language feels the need to re-invent the wheel because they drive on slightly different roads.

  • 1 hidden comment

  • • Re:

      Like all the replacements for "old" tools that were just fine for decades. Traceroute, nslookup, ifconfig, etc etc. Tell me again why nslookup was retired and moved to legacy support?

      • Re:

        Because nslookup is architecturally flawed. It doesn't use bind for looksups but a separate library and algorithm and makes queries not inquired about and can give errors in unexpected ways and can fail in ways that can give misleading or incorrect errors and is semi useless for diagnosing local issues as it steps around the local system and then makes queries that are semi nonsensical that sort of made sense back when internet connections were generally intermittent and UUCP was a common way to communica

    • Re:

      It's because they have looked at what has gone before and realized how bad it is and thought "well, even if my new package manger is garbage at least my new package manager won't have these problems all of the other ones have"

      Of the last 20 software projects I had some responsibility for securing they averaged just over 1,000 external dependancies per project. The fact that modern package managers even semi support this is both amazing and terrifying. There are real issues in trying to maintain the secu

• Re:

  I never really got the appeal of these "package managers" that are language specific. Too much proprietary tech constantly trying to re-invent the wheel.

  Let me count the ways.

  1) Hackers are constantly prying into libraries looking for vunerabilities. You are not a security expert, you didnt write the code and you probably dont have time to inspect the entire codebase (especially if its a big one). Modern dependency management gives you access to tools to ensure your notified when vunerabilities are found in