Hacker News Reader

Comment by efitz | Hacker News Reader

> The volume of malicious users and malicious projects being created on the index in the past week has outpaced our ability to respond to it in a timely fashion, especially with multiple PyPI administrators on leave.

People suck and that is why we cannot have nice things.

View on HN

It’s calle Tragedy of Commons

https://en.m.wikipedia.org/wiki/Tragedy_of_the_commons

One solution would be have a minimum payment or a trusted sponsor in order to register a new package. A minimum trust score through well-known community persons, or reduce spam by payments.

On the root cause why people suck is that different cultures and different people have different values. For many people making money by spamming is not an issue in their own internal value system. Thus, it is better to be tackled by making spam unprofitable.

I disagree that this is a case of tragedy of the commons (totc). Totc is about unregulated depletion of resources, just like your link says. This pypi stuff is about maliciousness. Criminal or misanthropic behavior is not totc; it's just antisocial.

Also, https://aeon.co/essays/the-tragedy-of-the-commons-is-a-false...

The shame of it is that a tiny, tiny, tiny fraction of people really suck. The number of people involved is probably less than a thousand. (This is my totally uninformed speculation.)

Yes, people suck and I wish they didn't but the other side of the problem is that the centralized flat-namespace model of PyPI is especially vulnerable.

Reply on news.ycombinator.com