Hacker News new | past | comments | ask | show | jobs | submit login

PyPi is in a tough spot because they're also getting hit with an onslaught of malicious packages, which got to such a bad point they had to disable signups. How do they mitigate that kind of activity without logging basic metadata like the IP address that published a package? Also, as a user of PyPi, wouldn't you prefer that a malicious package is at least _somewhat_ traceable to an attacker? Of course most would be behind a VPN but it's better than nothing (or maybe it's not, depending on the tradeoff).

Note that the blog post doesn't say they handed the entire database over to the feds. They received three warrants scoped to specific packages and returned only the data they had available that was associated with those packages.




> How do they mitigate that kind of activity without logging basic metadata like the IP address that published a package

An effective mitigation for abuse/spam is to increase its cost. One example is to require payment.


That's also a highly effective mitigation against legitimate users, especially those already disadvantaged everywhere else by a lack of disposable income.


How did you conclude payment equals parting with the money and not getting it back? Collateral works well for many problems in the world.


It would not go over well if PyPI started charging people to host packages.


Charging goes well for many online services. Hosted email, hosted VPS, and hosted SaaS are some that come to mind. Apple Store and Google Play charge to host mobile games.


And the feds can subpoena all those services and their payment providers for logs including IP address that made the transaction.


Notably, none of your examples include the central distribution service which underpins a whole FOSS ecosystem.


Now they need to subpoena both PyPI and the payment processor. It does slow them down but effectively does nothing to "thwart future subpoenas from the total surveillance state".




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: