Thanks for the diligence here. On Wed, Aug 10, 2016 at 3:55 PM, Thomas Kluyver <[email protected]> wrote:
> At least on PyPI, I believe that the hashes are more intended to check > download integrity than security. The new PyPI that's in the works does > appear to show SHA256 hashes (see https://pypi.org/project/ipython/#files > ). But the strongest hash function in the world won't protect us if someone > steals our PyPI login credentials and uses them to upload valid releases. > > On 10 August 2016 at 23:01, Big Stone <[email protected]> wrote: > >> pypi , R , anaconda are showing mainly md5 on their website (and >> plumbing?) : shouldn't they use and popularize stronger hash technics ? >> >> On Wednesday, August 10, 2016 at 11:09:14 PM UTC+2, takowl wrote: >>> >>> Someone tried to get access to Kenneth Reitz's Github account, possibly >>> with the intent of tampering with requests. As maintainers of another >>> prominent Python project, we should be vigilant with our own accounts. >>> >>> We already asked everyone with commit rights to enable two-factor >>> authentication. This demonstrates that was a good idea. But we should be >>> aware of other attack vectors, like DNS providers and PyPI (you typically >>> store PyPI passwords in plain text in a hidden .pypirc file). >>> >> -- >> You received this message because you are subscribed to the Google Groups >> "Project Jupyter" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to [email protected]. >> To post to this group, send email to [email protected]. >> To view this discussion on the web visit https://groups.google.com/d/ms >> gid/jupyter/acdc4d6d-373a-410d-b9e8-7f01e29b287b%40googlegroups.com >> <https://groups.google.com/d/msgid/jupyter/acdc4d6d-373a-410d-b9e8-7f01e29b287b%40googlegroups.com?utm_medium=email&utm_source=footer> >> . >> For more options, visit https://groups.google.com/d/optout. >> > > -- > You received this message because you are subscribed to the Google Groups > "Project Jupyter" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > To post to this group, send email to [email protected]. > To view this discussion on the web visit https://groups.google.com/d/ > msgid/jupyter/CAOvn4qg6icTxNzJBjAm7BCLiGLnFHZKjvwaHMoq5ujj7rZ1FJQ%40mail. > gmail.com > <https://groups.google.com/d/msgid/jupyter/CAOvn4qg6icTxNzJBjAm7BCLiGLnFHZKjvwaHMoq5ujj7rZ1FJQ%40mail.gmail.com?utm_medium=email&utm_source=footer> > . > > For more options, visit https://groups.google.com/d/optout. > -- Kyle Kelley (@rgbkrk <https://twitter.com/rgbkrk>; lambdaops.com) -- You received this message because you are subscribed to the Google Groups "Project Jupyter" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/jupyter/CA%2BtbMaUXzVdSjwmgGjdyqhOuimPSZ5pjexxQ6bdqnTAOJz3m-g%40mail.gmail.com. For more options, visit https://groups.google.com/d/optout.
