* There is no namespaces, so all internal packages must be individually protected * It's easy to misconfigure the various python package tools to open you up to dependency confusion attacks * The only effective protection mechanism that you can implement across a large enterprise fills the index with spam and is forbidden
It would really improve things if they could introduce namespaces and let legal entities own those.
That’s not a perfect solution, but so far that DNS is the namespace with mainstream acceptance and builtin lawyers that a single entity cannot e.g. just singlehandedly sanction, sue or simply “reserve the right to refuse” people out of—in practice, for the most part.
PyPI’s (and CPAN’s, CTAN’s, Hackage’s, NPM’s) centralized index was originally a (deliberately) crude solution to the discoverability problem, at least in part. These days, we have adopted a different bad solution—putting everything on a Microsoft-owned hosting service with a crap search function. That is also quite bad, but maybe it’s time we recognize it happened anyway and stop making concessions to the old solutions in our package naming schemes.