Re: pre-PEP: transition to release-file hosting at pypi site
Jacob Kaplan-Moss <[email protected]> Tue, 12 Mar 2013 10:42:28 -0500
| Newsgroups | gmane.comp.python.catalog |
|---|---|
| Message-ID | <CAK8PqJFXQkh2s21CJ=9QphQyf36Uqq7TrPx+nFbukq8TY=wqwQ@mail.gmail.com> |
On Tue, Mar 12, 2013 at 10:38 AM, PJ Eby <[email protected]> wrote: > I'll ask it again: why should *thousands* of projects be censored or > made to change their release processes, because *you* can't be > bothered to cache the distributions of the projects you depend on? Because externally-hosted files are a security risk, one that most users don't realize exists. We can either fix this problem now, or we can wait until someone is compromised using PyPI as a vector. Jacob