On Fri, Apr 6, 2018 at 9:55 PM, Donald Stufft <don...@stufft.io> wrote:
>> On Apr 6, 2018, at 4:28 PM, Matthew Brett <matthew.br...@gmail.com> wrote:
>> Ouch - it does look like we're in a very difficult situation, which
>> might apply to a significant number of users.
>> I think the worst option is what we have ramping up in the brownout,
>> which is the silent failure to upgrade or find packages. Yes, you
>> get something informative with the -v option if you think to try it,
>> but I think the confusion from the not -v state is of much greater
>> harm than the help from the -v message.
>> The better option, I believe, is just to go straight to the SSL error.
>> At least that will set people Googling. They might be annoyed, but at
>> least they won't be mystified.
>> Ideally, that would happen as late as possible, to give people the
>> maximum chance to upgrade with the usual pip upgrade commands. One of
>> the nasty features of this one is that it breaks the normal pip
>> upgrade method. Can we push back the SSL error until it's forced upon
>> us in June?
> Not without delaying the launch of Warehouse until after June (at which point
> we will have already run out of MOSS grant money and won’t have people with
> paid, dedicated time on hand to sort out any issues that crop up from the
> launch). This is because portions of Warehouse are already mandatory TLSv1.2
> and that can’t be rolled back (Warehouse is new enough on Fastly it never had
> TLSv1.0/1.1 support).
> It’s not great, but it’s the least bad option we have right now.
OK - so our hard deadline is the planned Warehouse launch on April
16th? I would argue for going straight to the SSL error at that
point, and turning off the current brownout and April 8th TLS 1.0 shut
down. Is that possible? Do other Macolytes agree with me that that
would be less confusing? In the mean time, would it be possible to
put out some big announcements following up on the originals, giving
the SSL error, to seed Google searches, and prime memories?