Hacker News Reader

Comment by BiteCode_dev | Hacker News Reader

From the article:

> The message to me as a maintainer is quite clear: once a project achieved criticality, then the index wants to exercise a certain amount of control

I don't think that's the definition of control. Pypi gains no power with this, only more work.

And 2FA is really not a big deal.

> One could imagine that an index would like to enforce cryptographic signing of newly released packages.

Yes. Please yes.

Letsencrypt was a boon to the web.

Having a quick way to sign your package to send it so pypi would be a great thing.

This is a long article over nothing.

View on HN

2FA is a pain in the ass and provides minimal extra security. The reason why companies employ it is because their users are incompetent and will install malware on their desktop OS, so they shift the burden of security to locked-down mobile operating systems like Android and iOS.

If an experienced user does not want to use 2FA, they will run the 2FA app in a virtual machine and automate it. You can't force them to 2FA but you can inconvenience them and tie them down to a phone number, SMS, or locked-down hardware (through remote attestation).

>Letsencrypt was a boon to the web.

Letsencrypt and the existing PKI structure just forces everyone's eggs into a single basket, Ripe for exploitation from the government.

In this particular case, Pypi is giving away hardware security key.

I have 3 of them, it is secure and convenient.

With root certificates, gov already have complete ability to MITM your https connection.

> Having a quick way to sign your package to send it so pypi would be a great thing.

I guess we just need to make signing easy then.

Which remains a hard problem.

What, exactly, is hard about signing?

We've been working with PyPI to help integrate Sigstore, which makes signing (and verification) easier!

sigstore.dev

I'll have to check out sigstore.

Anything that makes signing/verifying easier is a welcome change.

We used to say that about https, and now we got letsencrypt.

LE made SSL/TLS easy, we need something similar for sign/verify of packages/software.

Another commenter mentioned sigstore.dev which looks potentially interesting.

Reply on news.ycombinator.com