miketheman

The infrastructure sponsors can be found in the PyPI footer, and here: https://pypi.org/sponsors/#:~:text=Infrastructure%20sponsors

Whoops, sorry about that. Should be fixed now. Happy New Year!

PyPI responses are cached at 99% or higher, with less infrastructure to run.

Search is an unbounded context and does not lend itself to caching very well, as every search can contain anything

Alpha Omega is proud to share the newly published white paper from Seth Larson of the Python Software Foundation, titled “Slippery Zips and Sticky Tar Pits: Security and Archives.” Seth serves as Python’s Security Developer in Residence, a role sponsored by Alpha Omega, focused on improving the safety and trustworthiness of open source software that powers systems and applications everywhere.

Incident report of a recent attack campaign targeting GitHub Actions workflows to exfiltrate PyPI tokens, our response, and steps to protect your projects.

This largely depends on the ICANN policies and their definitions of Renewal and Registration Grace Periods. The Renewal period is variable, but the Registration Grace Period is pretty much 30 days everywhere.

https://www.icann.org/en/contracted-parties/consensus-polici...

Here's an example from denic.de: https://www.denic.de/en/domains/de-domains/domain-deletion#c...

PyPI now checks for expired domains to prevent domain resurrection attacks, a type of supply-chain attack where someone buys an expired domain and uses it to take over PyPI accounts through password resets.

There is an active phishing attack targeting PyPI users.

• Threat: Emails from noreply@pypj.org (with a 'j') link to a fake login page.

• Action: Do not click any links. If you already did, change your PyPI password ASAP.

• Note: PyPI itself has not been breached.

Sadly the majority of this data is not externally visible.

Thank you!

Excellent idea, and something I tried a little while back. The `pytest-postgresql` plugin used has the ability to do this natively, but when we tried it out we found that we had other issues with developing on a Linux machine.

Attempt: https://github.com/pypi/warehouse/pull/15365

Revert: https://github.com/pypi/warehouse/pull/15444

If you've got experience with making this kind of thing work on Linux development machines, it'd be great to have some help getting that back.

How so? PyPI launched in 2003, PyPy's first release was in 2007. https://www.pypa.io/en/latest/history/#before-2013

Apologies for any frustration, user registrations are now open now that admins have returned.

Depends on funding. Ask your employer to pitch in!

Check out https://chrisholdgraf.com/blog/2022/install-github-from-pypr... which breaks down a few ways to to this.

So sorry to hear that. I looked at our account recovery requests repo and didn't see anything from `arnon` or similar usernames.

We have the published account recovery process here: https://pypi.org/help/#account-recovery

Is that the process you've followed?

If you are the sole owner of a project, you can still delete the project. That's not great right now. There's a conversation topic that you might find interesting: https://discuss.python.org/t/stop-allowing-deleting-things-f...

None taken :)

PEP 458 describes the path forward for PyPI. https://peps.python.org/pep-0458/

Here's the in-progress roadmap: https://github.com/pypi/warehouse/issues/10672

If there's particular issues you believe you could pick off to help achieve the goal, much appreciated!

Project deletion would fall under "management".

Account deletion is excluded so you can elect to remove your account at any time.

Turns out we already do! When setting up 2FA, select WebAuthN and create a label for your device. When prompted, follow directions on your device.

Thanks for the suggestion!

The image you showed is in regards to Passkeys, which PyPI doesn't support yet.

For TOTP, we support a single entry, and can't set a custom name.

For WebAuthn, we allow a custom label value, is that what you're looking for?

Software's software ;)

> I would never use Python for a fully interactive high traffic service sitting on the open internet.

So, nothing like Instagram, Dropbox, or YouTube?

I threw together a one-liner to disable: https://twitter.com/mikefiedler/status/1487439545779949571

I was very surprised to receive a few emails late on a Friday that a new feature was auto-enabled on AWS accounts that have never run Kubernetes, and informing me that I'll start paying for a service in 30 days unless I disable it.

Truth! Wouldn't have it any other way. ;)

Wow, that's a lot of indirection! I've had the same setup, but only two requests deep. I think that if there's added value of each nginx tier (if each service has static assets, for example), then there may be some benefit, but tracing through all the layers gets harder. Glad to hear you removed the internal layers!

Possibly! I wasn't trying to get the highest RPS, rather find a baseline and compare per architecture. I also wrote what I knew how write in a short amount of time. ;)

I'm not sure I understand? These examples all use the Fargate compute layer and are deployed as a Task which colocates both containers on the same hardware, so there's no cross-machine factors to contend with.

Good to know! Would you be interested in performing the same tests and using `wrk` and report the difference?