Hacker News Reader

Comment by avgcorrection | Hacker News Reader

> The privacy of PyPI users is of utmost concern to PSF and the PyPI Administrators, and we are committed to protecting user data from disclosure whenever possible.

Don’t lead with this.

> In this case, however, PSF determined with the advice of counsel that our only course of action was to provide the requested data.

If you’re going to say this.

I’m not judging their decision. Maybe not going to prison is a greater concern to them. It’s fine to just say that you thought it was best to comply because [lawyer reasons that you don’t have to disclose to anyone]/counsel.

EDIT: Or say “there are bad people out there and we trust the DOJ”. Whatever.

View on HN

It's a completely reasonable reading of their message to assume that the “possible” in “whenever possible” roughly means “legal”. I don't think any reasonable reading of it means to imply that they are willing to violate federal law.

Fair point.

Oke way to protect user data is to NOT ask/collect data in the first place. What's the need of person's full name and address for? Maybe I'm missing the point, but I see zero reasons to have this data in the first place.

If you read the whole thing, it's pretty clear they don't have the person's full name and address, and thus did not provide it. They do mention that it will be needed for organizations that sign up for billing when that feature becomes available.

Other than possibly IP addresses, it seems like the only information they had available to disclose was close to the bare minimum needed to operate the service.

You are probably reading what data the DoJ requested. Further down in the blogpost (in the "Details" section) they state that they don't have a lot of the data requested and exactly what kind of data they could and did provide. Addresses are not requested by PyPI.

And they state very clearly they don't have this information. In fact, PyPi seems to retain a very reasonable set of information, strictly related to the service itself. I found this disclosure to be entirely refreshing.

That’s the best principle to follow. Agreed.

sudo give us user data

Lighten up. Nobody's going to federal court to stop the DOJ from investigating botnets, carding rings, and ransomware scams, which is what these things are usually about. Nobody's mental model of PyPI was that they had Signal's priorities.

Then all the less reason to roll out the “of utmost importance” boilerplate. So what’s your point?

Also I don’t see how being light-hearted has anything to do with this submission, Thomas.

Its just they have no choice. And when they do the choose their "utmost priority". Its not that complicated

Then they shouldn't say protecting their users are their top priority, because they have shown it is not. That's called lying. A correct statement would have been "we will comply with lawful LEO requests"

How have they shown it's not, exactly? Really curious what you think they could have done better aside from blatantly going against laws in their jurisdiction.

There's a difference between abiding by lawful court orders that have gone through judicial process and a friend in a police department calling in a favour.

Helping convict scammers, typo-squatters injecting malicious code, etc is protecting their users. Just not the (likely) bad actors that are the subject of the subpoenas.

The fact remains, that unless you are willing to break the law, obeying the law is your top priority.

This assumes that all of this is binary, when in reality it’s a complex system that takes time and effort to modify in a meaningful and responsible way.

If you're so inclined, you're welcome to make an anarcho-oriented package management system yourself. PyPi has never claimed to be one, though.

I don’t see anything conflicting in what they said.

They can feel that way, and comply.

Yeah. I was probably being a little too boilerplate (what looked like) -intolerant. ;)

Reply on news.ycombinator.com