7 ms·

Atomicwrites' old versions have been purged from PyPI

46 points by afturner 4y ago

staticassertion 4y ago
I assume/ hope that this is PyPI's first step in rolling out mandatory 2FA? Otherwise the whole "you're critical so you have to enable it" seems a bit silly in that you're going to have developers who get critical decide they don't want to do this, and at that point pull packages/ stop maintaining. Just having a 2FA requirement from the start (or some grace period like 7 days) seems like the way to do it.
legobmw99 4y ago
Someone on Reddit [1] ran their own version [2] of the query PyPi used to make this determination. Over the last 6 months, atomicwrites was downloaded 38,497,903 times, good for just under #400 by rank. [1] https://old.reddit.com/r/Python/comments/vuh41q/pypi_moves_to_require_2fa_for_critical_projects https://old.reddit.com/r/Python/comments/vuh41q/pypi_moves_t... [2] https://gist.github.com/jack1142/efe5c89b861a41616aaf858783835eed https://gist.github.com/jack1142/efe5c89b861a41616aaf8587838...
afturner 4y ago
PyPI identifies a package as critical and asks the maintainer to enable 2FA.. but allows them to simply delete the package to get around this requirement?
- mwarkentin 4y ago
  Apparently when the 2fa requirement is actually implemented (this was just an announcement which triggered this) deleting a package would require 2fa as well. Other registries go further and make it harder or impossible to delete once certain criteria are met (pretty sure this was put in place after leftpad broke the whole ecosystem): https://docs.npmjs.com/unpublishing-packages-from-the-registry https://docs.npmjs.com/unpublishing-packages-from-the-regist...
- jbverschoor 4y ago
  His right
  - dmart 4y ago
    I dunno, I think if you publish a copy of your code to a registry then it would be both desirable and reasonable for that copy to be immutable. Allowing the deletion of published libraries can have huge downstream impacts and ultimately makes the registry less trustworthy. Edit: to be clear, not trying to shame the author here - it sounds like they tried to avoid this situation: "what i didn't consider is that this would delete old versions. those are apparently now gone and yet it's apparently not possible for me to re-upload them. i don't think that's sensible behavior by pypi, but either way i'm sorry about that." I think this is a bad design on PyPI's part though.
    - jbverschoor 4y ago
      If you want immutable, use a blockchain. Life is not immutable. There could be a claim about IP, malware, whatever. Versions should be immutable, but possible to delete
    - Wowfunhappy 4y ago
      I agree. The logic is similar to why you can't delete an HN comment once someone replies.
      - jbverschoor 4y ago
        Well sure. But what happens if your post contained some confidential data? It gets redacted
        Wowfunhappy 4y ago
        Yes, but you have to email the HN mods, so there's a form of review built into the process. It can't be done unilaterally.
djhaskin987 4y ago
From the GitHub README: > PyPI wants me to enable 2FA just because I maintain this package, which I don't care for. So this package is now unmaintained. Just set up a KeepassXC file and put your 2FA info in there? You don't need to give PyPI your phone info, PyPI takes TOTP[1]. 2FA is pretty normal; I don't see why the author has a problem with it. It doesn't violate privacy (since it's not actually tied to any PII like a phone number), it takes like 10 seconds to set up, and it protects your packages from hackers. Perhaps the author simply doesn't see the point of 2FA, since he implies the PyPI authors only did it for compliance reasons (and not for normal bolt-your-doors security reasons, which is more likely)? He calls setting up 2FA "an expense of my free time" when surely it took more time for him to delete and re-add his package than it would have to just set up 2FA. EDIT: To be fair, the maintainer owes us nothing[2], sure. But it's not unreasonable to protect the larger community with basic security practices, either. 1: https://pypi.org/help/#twofa https://pypi.org/help/#twofa 2: https://gist.github.com/richhickey/1563cddea1002958f96e7ba95 https://gist.github.com/richhickey/1563cddea1002958f96e7ba95...
- jbverschoor 4y ago
  Or you just maintain it?
- lbhdc 4y ago
  I can't blame them, I would have done the same. I assume their priorities are not aligned with pypi and have no incentive to jump through those hoops.
- krasin 4y ago
  >but his response feels more so If we keep treating open source maintainers like they owe us anything, we will have fewer open source maintainers.
  - djhaskin987 4y ago
    That's fair, he owes us nothing[1]; I agree with that. But it's not unreasonable to protect the larger community with basic security practices, either. 1: https://gist.github.com/richhickey/1563cddea1002958f96e7ba9519972d9 https://gist.github.com/richhickey/1563cddea1002958f96e7ba95...
jamesboehmer 4y ago
You know which modules I'm not using for my critical projects? Ones whose maintainers refuse to enable 2fa. We already know how supply chain security problems have plagued npm and pypi. Dependabot should alert you when your dependency comes from a package maintainer that doesn't use 2fa.
- Wowfunhappy 4y ago
  That's entirely reasonable. However, it is also reasonable for the author, who is working for free, to ignore your concerns.
  - eternityforest 4y ago
    I think it's completely insane to not use 2FA when available... but I also support the freedom to not maintain a piece of software unpaid. One person projects are pretty miserable.
    - adastra22 4y ago
      I have ADHD. I lose things. I once had to restore access to a 2FA protected account I’d lost the token to. It took weeks of back-and-forth and involved sending personal information (selfies with identity cards) the service had no business knowing. Never again. Especially for an unpaid personal project for which I owe nobody anything. If PyPI sent me this email, I’d immediately nuke all versions of all packages I maintain, replace with a blank/no code “upgrade” version that contains nothing but a readme explaining what happened, and close/deactivate my account.
      - eternityforest 4y ago
        I lose things incredibly often too(Like, losing my wallet twice and keys once, all within a 12 month period, going inside and leaving keys in the front door, needing GPS to get home 3 blocks away, etc). If 2FA was token based as people seem to want it to be, I'd have an issue, but SMS based is enough to keep out the majority of opportunistic attackers while being recoverable. Plus, there's always printable recovery codes with Google at least.
ary 4y ago
This is a bizarrely emotional response to me. PyPI offered to provide a security key to make the maintainer's life easier so it's hard to see this as an "entitled" act. When I see the core infrastructure for open source software ecosystems improve I cheer that effort on. While I am in full support of not asking too much of open source maintainers a cooperative stance makes the overall situation better for everyone involved. This could have been handled in a better way.
- savant_penguin 4y ago
  Maybe some people use their side projects to develop software without the bureaucratic crap full time jobs have. And any amount of bureaucracy is too much for his free side project
  - staticassertion 4y ago
    So why publish to PyPI? I have tons of personal projects that never leave my laptop, or, at most, github.
    - deleted 4y ago
      [deleted]
    - eesmith 4y ago
      I had a package which I didn't publish on PyPI, just my web site as a "if you break it, you get to keep the pieces" sort of thing. I didn't even have a PyPI account. Someone else added it to PyPI without telling me. And people started using it from PyPI. I started getting messages about it, like PyPI developers asking maintainers to upgrade package metadata to include if it supported Python 3. That's when I realized it was on PyPI in the first place. I had to contact the original uploaded to get access to the account. One user even emailed me a question and said I had an obligation to support it, since I put it on PyPI. Damned if you do, damned if you don't.
      - staticassertion 4y ago
deleted 4y ago
[deleted]
AngusH 4y ago
The whole package has now been deprecated by the maintainer: 'PyPI wants me to enable 2FA just because I maintain this package, and both that and the mess resulting from a stunt of mine, I thought it'd be a good time to deprecate this package. Python 3 has os.replace and os.rename which probably do well enough of a job for most usecases.' https://github.com/untitaker/python-atomicwrites https://github.com/untitaker/python-atomicwrites Edit: From the bug report 'I decided to deprecate this package. While I do regret to have deleted the package and did end up enabling 2FA, I think PyPI's sudden change in rules and bizarre behavior wrt package deletion doesn't make it worth my time to maintain Python software of this popularity for free. I'd rather just write code for fun and only worry about supply chain security when I'm actually paid to do so.' I can see the maintainers point, even if it may be inconvenient.
- staticassertion 4y ago
  That sounds like a best of both worlds. PyPI sets a minimum bar for developer responsibility and you can opt out of publishing to PyPI if you don't want to be that responsible. The system works.
  - whizzter 4y ago
    I wonder how people who maintain CI pipelines feels about it on monday if they're recalled from vacations because the pipelines broke.
    - daedalus2027 4y ago
      they are being paid for being recalled from vacations while this developer is doing it for free... that was his point...
      - whizzter 4y ago
        Oh I agree, my point was rather that the haphazard way of handling this by the PyPi folks.
lostmsu 4y ago
Also got this letter of happiness. I don't mind 2FA, already had it set up. But PyPi is weird. I wanted to add a secondary 2FA device for backup, but they would not just let me do it. I had to download recovery codes first. But what am I going to do with them? Unlike 2FA tools there's no convenient way to store them. But because they insisted (and they really did by immediately asking me to burn one of them) I just saved them into a random file on my local disk. I suppose I could delete them, but I would rather not have gotten them in the first place.

46 points by afturner 4y ago

I assume/ hope that this is PyPI's first step in rolling out mandatory 2FA? Otherwise the whole "you're critical so you have to enable it" seems a bit silly in that you're going to have developers who get critical decide they don't want to do this, and at that point pull packages/ stop maintaining. Just having a 2FA requirement from the start (or some grace period like 7 days) seems like the way to do it.

legobmw99 4y ago

Someone on Reddit [1] ran their own version [2] of the query PyPi used to make this determination. Over the last 6 months, atomicwrites was downloaded 38,497,903 times, good for just under #400 by rank. [1] https://old.reddit.com/r/Python/comments/vuh41q/pypi_moves_to_require_2fa_for_critical_projects https://old.reddit.com/r/Python/comments/vuh41q/pypi_moves_t... [2] https://gist.github.com/jack1142/efe5c89b861a41616aaf858783835eed https://gist.github.com/jack1142/efe5c89b861a41616aaf8587838...

afturner 4y ago

PyPI identifies a package as critical and asks the maintainer to enable 2FA.. but allows them to simply delete the package to get around this requirement?

mwarkentin 4y ago
Apparently when the 2fa requirement is actually implemented (this was just an announcement which triggered this) deleting a package would require 2fa as well. Other registries go further and make it harder or impossible to delete once certain criteria are met (pretty sure this was put in place after leftpad broke the whole ecosystem): https://docs.npmjs.com/unpublishing-packages-from-the-registry https://docs.npmjs.com/unpublishing-packages-from-the-regist...
jbverschoor 4y ago
His right
- dmart 4y ago
  I dunno, I think if you publish a copy of your code to a registry then it would be both desirable and reasonable for that copy to be immutable. Allowing the deletion of published libraries can have huge downstream impacts and ultimately makes the registry less trustworthy. Edit: to be clear, not trying to shame the author here - it sounds like they tried to avoid this situation: "what i didn't consider is that this would delete old versions. those are apparently now gone and yet it's apparently not possible for me to re-upload them. i don't think that's sensible behavior by pypi, but either way i'm sorry about that." I think this is a bad design on PyPI's part though.
  - jbverschoor 4y ago
    If you want immutable, use a blockchain. Life is not immutable. There could be a claim about IP, malware, whatever. Versions should be immutable, but possible to delete
  - Wowfunhappy 4y ago
    I agree. The logic is similar to why you can't delete an HN comment once someone replies.
    - jbverschoor 4y ago
      Well sure. But what happens if your post contained some confidential data? It gets redacted
      - Wowfunhappy 4y ago
        Yes, but you have to email the HN mods, so there's a form of review built into the process. It can't be done unilaterally.

djhaskin987 4y ago

From the GitHub README: > PyPI wants me to enable 2FA just because I maintain this package, which I don't care for. So this package is now unmaintained. Just set up a KeepassXC file and put your 2FA info in there? You don't need to give PyPI your phone info, PyPI takes TOTP[1]. 2FA is pretty normal; I don't see why the author has a problem with it. It doesn't violate privacy (since it's not actually tied to any PII like a phone number), it takes like 10 seconds to set up, and it protects your packages from hackers. Perhaps the author simply doesn't see the point of 2FA, since he implies the PyPI authors only did it for compliance reasons (and not for normal bolt-your-doors security reasons, which is more likely)? He calls setting up 2FA "an expense of my free time" when surely it took more time for him to delete and re-add his package than it would have to just set up 2FA. EDIT: To be fair, the maintainer owes us nothing[2], sure. But it's not unreasonable to protect the larger community with basic security practices, either. 1: https://pypi.org/help/#twofa https://pypi.org/help/#twofa 2: https://gist.github.com/richhickey/1563cddea1002958f96e7ba95 https://gist.github.com/richhickey/1563cddea1002958f96e7ba95...

jbverschoor 4y ago
Or you just maintain it?
lbhdc 4y ago
I can't blame them, I would have done the same. I assume their priorities are not aligned with pypi and have no incentive to jump through those hoops.
krasin 4y ago
>but his response feels more so If we keep treating open source maintainers like they owe us anything, we will have fewer open source maintainers.
- djhaskin987 4y ago
  That's fair, he owes us nothing[1]; I agree with that. But it's not unreasonable to protect the larger community with basic security practices, either. 1: https://gist.github.com/richhickey/1563cddea1002958f96e7ba9519972d9 https://gist.github.com/richhickey/1563cddea1002958f96e7ba95...

jamesboehmer 4y ago

You know which modules I'm not using for my critical projects? Ones whose maintainers refuse to enable 2fa. We already know how supply chain security problems have plagued npm and pypi. Dependabot should alert you when your dependency comes from a package maintainer that doesn't use 2fa.

Wowfunhappy 4y ago
That's entirely reasonable. However, it is also reasonable for the author, who is working for free, to ignore your concerns.
- eternityforest 4y ago
  I think it's completely insane to not use 2FA when available... but I also support the freedom to not maintain a piece of software unpaid. One person projects are pretty miserable.
  - adastra22 4y ago
    I have ADHD. I lose things. I once had to restore access to a 2FA protected account I’d lost the token to. It took weeks of back-and-forth and involved sending personal information (selfies with identity cards) the service had no business knowing. Never again. Especially for an unpaid personal project for which I owe nobody anything. If PyPI sent me this email, I’d immediately nuke all versions of all packages I maintain, replace with a blank/no code “upgrade” version that contains nothing but a readme explaining what happened, and close/deactivate my account.
    - eternityforest 4y ago
      I lose things incredibly often too(Like, losing my wallet twice and keys once, all within a 12 month period, going inside and leaving keys in the front door, needing GPS to get home 3 blocks away, etc). If 2FA was token based as people seem to want it to be, I'd have an issue, but SMS based is enough to keep out the majority of opportunistic attackers while being recoverable. Plus, there's always printable recovery codes with Google at least.

ary 4y ago

This is a bizarrely emotional response to me. PyPI offered to provide a security key to make the maintainer's life easier so it's hard to see this as an "entitled" act. When I see the core infrastructure for open source software ecosystems improve I cheer that effort on. While I am in full support of not asking too much of open source maintainers a cooperative stance makes the overall situation better for everyone involved. This could have been handled in a better way.

savant_penguin 4y ago
Maybe some people use their side projects to develop software without the bureaucratic crap full time jobs have. And any amount of bureaucracy is too much for his free side project
- staticassertion 4y ago
  So why publish to PyPI? I have tons of personal projects that never leave my laptop, or, at most, github.
  - deleted 4y ago
    [deleted]
  - eesmith 4y ago
    I had a package which I didn't publish on PyPI, just my web site as a "if you break it, you get to keep the pieces" sort of thing. I didn't even have a PyPI account. Someone else added it to PyPI without telling me. And people started using it from PyPI. I started getting messages about it, like PyPI developers asking maintainers to upgrade package metadata to include if it supported Python 3. That's when I realized it was on PyPI in the first place. I had to contact the original uploaded to get access to the account. One user even emailed me a question and said I had an obligation to support it, since I put it on PyPI. Damned if you do, damned if you don't.
    - staticassertion 4y ago

deleted 4y ago

[deleted]

AngusH 4y ago

The whole package has now been deprecated by the maintainer: 'PyPI wants me to enable 2FA just because I maintain this package, and both that and the mess resulting from a stunt of mine, I thought it'd be a good time to deprecate this package. Python 3 has os.replace and os.rename which probably do well enough of a job for most usecases.' https://github.com/untitaker/python-atomicwrites https://github.com/untitaker/python-atomicwrites Edit: From the bug report 'I decided to deprecate this package. While I do regret to have deleted the package and did end up enabling 2FA, I think PyPI's sudden change in rules and bizarre behavior wrt package deletion doesn't make it worth my time to maintain Python software of this popularity for free. I'd rather just write code for fun and only worry about supply chain security when I'm actually paid to do so.' I can see the maintainers point, even if it may be inconvenient.

staticassertion 4y ago
That sounds like a best of both worlds. PyPI sets a minimum bar for developer responsibility and you can opt out of publishing to PyPI if you don't want to be that responsible. The system works.
- whizzter 4y ago
  I wonder how people who maintain CI pipelines feels about it on monday if they're recalled from vacations because the pipelines broke.
  - daedalus2027 4y ago
    they are being paid for being recalled from vacations while this developer is doing it for free... that was his point...
    - whizzter 4y ago
      Oh I agree, my point was rather that the haphazard way of handling this by the PyPi folks.

lostmsu 4y ago

Also got this letter of happiness. I don't mind 2FA, already had it set up. But PyPi is weird. I wanted to add a secondary 2FA device for backup, but they would not just let me do it. I had to download recovery codes first. But what am I going to do with them? Unlike 2FA tools there's no convenient way to store them. But because they insisted (and they really did by immediately asking me to burn one of them) I just saved them into a random file on my local disk. I suppose I could delete them, but I would rather not have gotten them in the first place.