miketheman

7 ms·

1.
PyPI Blog: Incident File Hosting Errors(blog.pypi.org)
5 points by miketheman 9d ago|1 comments
2.
Metadata requests no longer tracked in PyPI download counts(blog.pypi.org)
8 points by miketheman 17d ago|1 comments
3.
PyPI Blog: Releases now reject new files after 14 days(blog.pypi.org)
86 points by miketheman 2mo ago|56 comments
4.
PyPI has completed its second audit(blog.pypi.org)
6 points by miketheman 5mo ago|0 comments
5.
Anthropic Invests $1.5M in the Python Software Foundation and OSS Security(pyfound.blogspot.com)
7 points by miketheman 8mo ago|1 comments
6.
by miketheman 9mo ago
The infrastructure sponsors can be found in the PyPI footer, and here: https://pypi.org/sponsors/#:~:text=Infrastructure%20sponsors
7.
by miketheman 9mo ago
Whoops, sorry about that. Should be fixed now. Happy New Year!
8.
by miketheman 9mo ago
PyPI responses are cached at 99% or higher, with less infrastructure to run. Search is an unbounded context and does not lend itself to caching very well, as every search can contain anything
9.
PyPI in 2025: A Year in Review(blog.pypi.org)
79 points by miketheman 9mo ago|42 comments
10.
PyPI and Shai-Hulud: Staying Secure Amid Emerging Threats(blog.pypi.org)
3 points by miketheman 10mo ago|0 comments
11.
PyPI: Trusted Publishing Growth, Now for GitLab Self-Managed and Organizations(blog.pypi.org)
2 points by miketheman 10mo ago|0 comments
12.
White Paper: Slippery Zips and Sticky Tar-Pits: Security and Archives(alpha-omega.dev)
2 points by miketheman 11mo ago|1 comments
13.
by miketheman 11mo ago
Alpha Omega is proud to share the newly published white paper from Seth Larson of the Python Software Foundation, titled “Slippery Zips and Sticky Tar Pits: Security and Archives.” Seth serves as Python’s Security Developer in Residence, a
14.
Open Infrastructure Is Not Free: PyPI, the PSF, and Sustainability(pyfound.blogspot.com)
8 points by miketheman 11mo ago|0 comments
15.
Datadog supports PyPI and the Python community through observability(opensource.datadoghq.com)
1 points by miketheman 11mo ago|0 comments
16.
PyPI Blog: Token Exfiltration Campaign via GitHub Actions Workflows(blog.pypi.org)
76 points by miketheman 1y ago|20 comments
17.
by miketheman 1y ago
Incident report of a recent attack campaign targeting GitHub Actions workflows to exfiltrate PyPI tokens, our response, and steps to protect your projects.
18.
by miketheman 1y ago
This largely depends on the ICANN policies and their definitions of Renewal and Registration Grace Periods. The Renewal period is variable, but the Registration Grace Period is pretty much 30 days everywhere. https://www.icann.o
19.
by miketheman 1y ago
PyPI now checks for expired domains to prevent domain resurrection attacks, a type of supply-chain attack where someone buys an expired domain and uses it to take over PyPI accounts through password resets.
20.
PyPI: Preventing Domain Resurrection Attacks(blog.pypi.org)
5 points by miketheman 1y ago|2 comments
21.
PyPI now serves project status markers in API responses(blog.pypi.org)
2 points by miketheman 1y ago|0 comments
22.
Preventing ZIP parser confusion attacks on Python package installers(blog.pypi.org)
48 points by miketheman 1y ago|17 comments
23.
PyPI Phishing Attack: Incident Report(blog.pypi.org)
8 points by miketheman 1y ago|1 comments
24.
PyPI Users Email Phishing Attack(blog.pypi.org)
2 points by miketheman 1y ago|2 comments
25.
by miketheman 1y ago
There is an active phishing attack targeting PyPI users. • Threat: Emails from noreply@pypj.org (with a 'j') link to a fake login page. • Action: Do not click any links. If you already did, change your PyPI password ASAP. • Note:
26.
by miketheman 1y ago
Sadly the majority of this data is not externally visible.
27.
by miketheman 1y ago
Thank you!
28.
PyPI Prohibits inbox.ru email domain registrations(blog.pypi.org)
131 points by miketheman 1y ago|105 comments
29.
by miketheman 1y ago
Excellent idea, and something I tried a little while back. The `pytest-postgresql` plugin used has the ability to do this natively, but when we tried it out we found that we had other issues with developing on a Linux machine. Attempt: htt
30.
AWS Lambda standardizes billing for INIT Phase(aws.amazon.com)
7 points by miketheman 1y ago|1 comments

More ›