@hipsterelectron@circumstances.run
2025-08-19 15:35 UTC
@astraluma@tacobelllabs.net @pypi@fosstodon.org it also seems that there is no way to re-verify an email address once it's been secretly marked as unverified? so presumably this will go unnoticed until the maintainer loses access to their account as a result of a subsequent supply chain security effort. and since the domain expiration status is admittedly made up the only way to ensure you won't suddenly lose access to all your packages based on decisions you cannot audit or be made aware of is to add a gmail address.
Replies (1)
-
@hipsterelectron@circumstances.run 2025-08-19 15:51
@astraluma@tacobelllabs.net @pypi@fosstodon.org notable that a statistical argument was also used to remove support for pgp keys https://blog.pypi.org/posts/2023-05-23-removing-pgp/ even though the whole point of pgp is that using it does not require rendezvousing with a third-party service (because it is an anti-surveillance tool) so you cannot estimate the prevalence of its usage.