[Catalog-sig] Proposal: close the PyPI file-replacement loophole

[Donald Stufft]

and by all means, a lot of things aren't protected when the server itself is compromised, we should go ahead and disable any of those that are even mildly annoying too. 


On Tuesday, January 31, 2012 at 7:40 PM, Terry Reedy wrote:

> On 1/31/2012 6:43 PM, Donald Stufft wrote:
> > I don't think anyone is arguing that it's not occasionally useful. The
> > question to answer is the occasional usefulness worth the risks that
> > come with it. In my opinion the small utility (being able to correct a
> > borked packaging job) is not worth the risks to both my applications
> > stability, and the security of my entire system.
> > 
> 
> 
> The question is whether, on each issue, PyPI should be optimized for 
> authors (who provide their modules for free) or for users. Both choices 
> are defensible. However, if all choices are made in favor of users, 
> there will very likely be fewer things uploaded or even listed, which is 
> not favorable for users.
> 
> It is hard to take your security concerns too seriously when you 
> consistently ignore security suggestions. Prohibiting deletion or 
> replacement by authors will give you no protection against the site 
> being compromised by other means, whereas the suggestions you ignore would.
> 
> -- 
> Terry Jan Reedy
> 
> _______________________________________________
> Catalog-SIG mailing list
> Catalog-SIG at python.org (mailto:Catalog-SIG at python.org)
> http://mail.python.org/mailman/listinfo/catalog-sig
> 
> 


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/catalog-sig/attachments/20120131/d0e95611/attachment.html>