di

25 ms·

1.
Shai-Hulud was the best thing to happen to supply chain security(aikido.dev)
1 points by di 21d ago|0 comments
2.
Planned Updates to the PyPI User Interface(blog.pypi.org)
8 points by di 2mo ago|0 comments
3.
Alphabet to Raise $80B in Equity Capital for Al Spending(bloomberg.com)
5 points by di 4mo ago|1 comments
4.
Departing the Python Software Foundation (Staff)(pyfound.blogspot.com)
4 points by di 8mo ago|0 comments
5.
by di 10mo ago
Maven Central does not currently support OIDC-based authentication (commonly called "Trusted Publishing").
6.
by di 11mo ago
For some context on the scale of this grant, the PSF took in only $1M in "Contributions, Membership Dues, & Grants" in 2024: https://www.python.org/psf/annual-report/2024/
7.
by di 11mo ago
It says "September 23, 2025" right at the top.
8.
by di 11mo ago
Don't be embarrassed, it's a good book (and was my favorite too).
9.
Strengthening NPM security: Important changes to authentication and tokens(github.blog)
1 points by di 1y ago|0 comments
10.
by di 1y ago
Note that https://peps.python.org/pep-0440/#direct-references says: > Public index servers SHOULD NOT allow the use of direct references in uploaded distributions. Direct references are intended as a tool for softwa
11.
New in CSS: Relative Colors(stefanjudis.com)
18 points by di 2y ago|0 comments
12.
AI-Powered Fuzzing: Breaking the Bug Hunting Barrier(security.googleblog.com)
3 points by di 3y ago|0 comments
13.
by di 3y ago
This is why PyPI recommends using Trusted Publishing ( https://docs.pypi.org/trusted-publishers/ ) which removes the need for long-lived tokens entirely.
14.
Python Package Management Proposal from Microsoft(devblogs.microsoft.com)
3 points by di 3y ago|1 comments
15.
Python Software Foundation announces new Security Developer in Residence hire(pyfound.blogspot.com)
2 points by di 3y ago|0 comments
16.
by di 3y ago
That article is about the packaging summit talk on introducing namespaces, not about organizations. In fact, when talking about organizations, it explicitly says: > But support for namespaces is not part of the new feature.
17.
by di 3y ago
> An example of this is that PyPI just got the ability to namespace packages. You're thinking of organizations, which are not namespaces: https://blog.pypi.org/posts/2023-04-23-introducing-pypi-orga...
18.
by di 3y ago
Pip supports checksums too. A better link might be https://pip.pypa.io/en/stable/topics/secure-installs/
19.
by di 3y ago
PyPI has never supported 2FA via SMS.
20.
by di 3y ago
Periods are not prohibited in package names, they're just uncommon (e.g., https://pypi.org/project/zope.sqlalchemy/ )
21.
by di 3y ago
Gitlab also doesn't support customizable OIDC audiences yet: https://gitlab.com/groups/gitlab-org/-/epics/7335
22.
The Thing(en.wikipedia.org)
12 points by di 4y ago|0 comments
23.
by di 4y ago
Previous discussion: https://news.ycombinator.com/item?id=34464657
24.
Wildcat Strike(en.wikipedia.org)
3 points by di 4y ago|0 comments
25.
by di 4y ago
Author here: yep.
26.
by di 4y ago
That's the point of the certificate authority and transparency log: it makes the public key known by publicly binding it to a verifiable identity. A hash verifies integrity, but has no way to demonstrate any relationship to a signing i
27.
by di 4y ago
Nope. The private key is generated within the client each time a signing event occurs, and that's what is used to sign the artifact. It doesn't come from the certificate. The certificate just binds the public key to the identity a
28.
by di 4y ago
The certificate specifically demonstrates that the <release-manager>@python.org identity signed the artifact. So there's a) no long-lived private key for them to lose (because it's never stored after signing) and b) a consum
29.
by di 4y ago
Anyone can generate a hash. Signing with a private key means that only the owner of that private key was able to generate a given signature. Singing with a private key which was bound to a known identity via a signing certificate proves tha
30.
by di 4y ago
Not sure if you're asking how to specifically do this for CPython, or how this works generally with Sigstore. For how this works specifically with CPython, see https://www.python.org/download/sigstore/ for de

More ›