Hacker News Reader

If they slip further down the slope you can, as a maintainer, protest there. 2FA is literally the least you can do to help prevent the kind of 'supply chain attacks' we've been seeing in the open source community for years now. If they continue, in spite of your protest, you can always distribute your library some other way or retire it.

View on HN

The author of the article this thread is about is litterally pushing further down that particular slope:

> And if your package gets established and has people regularly using it, you have some responsibility not to mess with those users. If you want to make backwards-incompatible changes, for example, communicate them and bump the major version number. If you want to stop maintaining the package, post an announcement about it and be willing to hand over to someone else to continue work.

Not really, none of those things are things he is suggesting PyPI should do, but rather social expectations that come from being a maintainer of a large project.

Sure, but they have the same implicit “… or else”, meaning losing the capacity to publish again on PyPI until they “fix their attitude”

Reply on news.ycombinator.com