On 27.02.2013 16:42, Donald Stufft wrote: > On Wednesday, February 27, 2013 at 10:39 AM, M.-A. Lemburg wrote: >> -1. >> >> There are many reasons for not hosting packages and distributions >> on PyPI itself. >> >> If you use and trust a package, you also have to know and trust its >> dependencies, no matter where they are hosted, so you're not gaining >> any security by disabling links to other download locations: if >> you don't trust the way a package is hosted, you don't use it; if >> you do, then removing the link breaks the package and all its >> dependencies. > > You also have to know and trust the hosting locations for all of them, and > if they are not available via SSL you have to know and trust that there is > not a MITM available.
Right. I'm not saying that it's not a good idea to host packages on PyPI, but forcing the community into doing this is not a good idea. >> Instead of suggesting to removing support for externally hosted packages, >> why not propose a mechanism to provide a more direct/secure way to >> reference them ? >> >> > > I did mention a method for doing that in my email. However there are reasons > beyond the security ones to require packages being hosted on PyPI. Namely > uptime, privacy, and performance. Your proposed uploading of hash values would require listing all distribution files for each release somehow. I don't see how you'd get that to work with older Python versions. """ 1. It is difficult to secure the process of spidering external links for download. 1a. The only way I can think offhand is by requiring uploading a hash of the expected files to PyPI along with the download link and removing all urls except for the download_url. This has the effect that only 1 file can be associated with a particular release. """ Uptime and performance have in the past been one of the reasons why people chose not to upload files to PyPI. This could be changed, of course. Another reason for not uploading files to PyPI are the license terms you have to agree to on PyPI and the fact that you can no longer control where your distribution files are made available by agreeing to them. This could be changed as well, but we'd need to add more legalese to the PyPI mirror setup for this to work... not sure whether people providing the mirrors would like this. Security can be had by having installers check the GPG signatures of distribution file. You don't need to trust the download site for that. I'm not sure what you meant with privacy in this context. Something that would work even with older Python versions is letting the download URL point to a meta-file which contains the links to the other distribution files. That way you avoid having the installers trying to parse arbitrary websites and you can add more security to the downloads by providing hash values, etc. in those meta-files. Since installers already know how to parse the /simple/ (HTML) index files, we might use that same format for those meta-files. -- Marc-Andre Lemburg eGenix.com Professional Python Services directly from the Source (#1, Feb 26 2013) >>> Python Projects, Consulting and Support ... http://www.egenix.com/ >>> mxODBC.Zope/Plone.Database.Adapter ... http://zope.egenix.com/ >>> mxODBC, mxDateTime, mxTextTools ... http://python.egenix.com/ ________________________________________________________________________ ::::: Try our mxODBC.Connect Python Database Interface for free ! :::::: eGenix.com Software, Skills and Services GmbH Pastor-Loeh-Str.48 D-40764 Langenfeld, Germany. CEO Dipl.-Math. Marc-Andre Lemburg Registered at Amtsgericht Duesseldorf: HRB 46611 http://www.egenix.com/company/contact/ _______________________________________________ Catalog-SIG mailing list Catalog-SIG@python.org http://mail.python.org/mailman/listinfo/catalog-sig