Hacker News Reader

Comment by tantalor | Hacker News Reader

"Someone"? Why don't public package managers like PyPI & npm require package owners to publish their real names and verify their identify, similar to WHOIS?

View on HN

A lot of the maintenance of these packages is performed by volunteers. Putting, however well-intentioned, barriers up will often result not in a more secure maintenance process but no maintenance at all. I'm generally happy to donate my patch that fixes an issue in a package I use, but that's not going to last long in the face of demands that I jump through hoops prove my identity (my interest in the following the bureaucratic procedures of an organization is closely related to the amount of money they are paying me). Particularly since my experience has been that organizations that are anal about that sort of confirmation tend to be more interested in passing any legal liability on to me rather than maintaining a secure maintenance process.

You misunderstand me. I don't think every single code contributor needs to divulge their identity. Only the package owner (one person) needs to vouch for the code in the package by putting their name on it. That person may have written none of the code, but they should be accountable for it. This is similar to how websites have domain owners.

I think you'll find the set of people simultaneously competent to maintain a python package and willing to take on potentially significant legal liability for free is too small to maintain a software ecosystem. This isn't necessarily bad: it means that the process of evaluating and securing code has tangible value and provides incentive to hire programmers or their consulting companies, which improves my odds of being able to feed my children in the future.

So you can sue them should their account get taken over or for other reasons? Or so that people can harass maintainers they do not like easier?

Looks like unneeded legal risks with no reward given people can already reveal their name if they want to.

The reward is improved security for the whole ecosystem because anonymous trolls will be discouraged from uploading garbage packages.

Someone"? Why don't public package managers like PyPI & npm require package owners to publish their real names and verify their identify, similar to WHOIS?

If you want a curated Python there’s Anaconda and ActiveState.

Recent trends in WHOIS (in Europe, at least) is to not show people’s names. People both deserve and need to be able to be anonymous:

https://geekfeminism.wikia.org/wiki/Who_is_harmed_by_a_%22Re...

Reply on news.ycombinator.com