I haven't listened to the interview but are they going to add namespaces? That's the only good solution I can see to the current unfixed dependency confusion issue.

By that I mean, you want to use a private pip repo in your company, you upload `yourcompany_secretproject` to it and tell people to install it. Now the only way to prevent yourself being hacked is to publicly register an empty package `yourcompany_secretproject` on pypi.org. Oh and also hope the admins don't notice it and remove it because it's empty (which they have said they will).

Insane situation.