Log file Viewer
#pypa-dev logs for Sunday the 22nd of February, 2015
[07:39:12] <pynpong> Hi, I am relatively new to Python and I am currently using pyenv in order to not contaminate my python's system default installation with other versions I may want to use for dev. I would like to install pip now, but I am not sure how would I go about it, for example, `python get-pip.py` is one way, but are there any other methods? Finally, since I am using `pyenv`, what is the recommended python version ~ to get pip. Thanks!
[21:08:04] <r1chardj0n3s> hai, so I guess we need the "how to deal with malicious code" policy finally eh?
[21:18:00] <dstufft> r1chardj0n3s: I don't know of a super good way to prevent the problem in general :/ It feels pretty crummy for projects to need to try and register common spelling mistakes to stop that, but I'm not sure if it's a good idea for claiming a name on PyPI to also try and claim "similar" names (and how do you even define what a similar name is? leveinstein distance of 1?)
[21:22:46] <tomprince> I guess there might be some with inserting a single letter or two letter prefix (which is perhaps reasonable) and very few others.
[21:34:03] <r1chardj0n3s> this looks simple enough - I've just gotta do the school run and then I'll get back to it
[22:01:31] <dstufft> If you see this page then you came here because you installed some honey pot package over pip. All data that is sent to this server is for pentesting purposes. For more information cosider visiting my blog.
[22:13:28] <r1chardj0n3s> even at distance 1.. there's a heck of a lot of TLA and 4LA names that collide
[22:18:05] <dstufft> r1chardj0n3s: it might make sense to step in the requirements, e.g at 3-4 letters you're going to have a lot of collides no matter what, but maybe at 5-6 a distance of 1 is good, but at 6+ a distance of 2
[22:19:04] <tomprince> And I think certain edits are less problematic and more likely (insertion at the begining, in particular, comes to mind).
[22:20:32] <r1chardj0n3s> dstufft.testpkg, dstufft.testpkg2, dstufft.testpkg22, dstufft.testpkg3 man what a hax
[22:22:49] <tomprince> I would be inclined to default to blocking, at least after a transition period, with a procedure for bypassing.
[22:23:56] <dstufft> r1chardj0n3s: where is the AUP? All I see is a thing that says "you give us a license"
[22:25:25] <dstufft> Like the name change policy and a CoC, an AUP defines what we define as OK and not OK to put on PyPI, things don't need to be overtly malicious for us not to want to host them. This guy is apparently claiming it was pentesting, that's not exactly malicious but it's something an AUP wouldn't allow
[22:31:36] <dstufft> the only way to solve is completely is curation yes, that doesn't mean there aren't ways to make it less of a problem. Without actually sitting down and doing some numbers though I don't know where the line between "complete wild west" and "whack a mole" lies
[22:32:00] <tomprince> This icident suggests that perhaps some level of curation is appropriate at small levenstein distances.
[22:32:02] <dstufft> We already do some normalization to prevent things like django and Django being different, and lol and 1ol
[22:33:00] <dstufft> it's possible that if we fiddle with the constraints something more (like leveinstein distance, or soudnex or something) might be another useful thing to apply, but it's also completely possible that the noise is too much
[22:33:53] <dstufft> something like setuptools or requests is a lot more useful than billy-bobs-i-have-no-users-and-was-only-uploaded-once-in-2008
[22:34:24] <dstufft> so it's possible to be stricter about matches to the top X packages than to the bottom Y
[23:17:12] <Ivo> dstufft: something happen to rst rendering? https://pypi.python.org/pypi/virtualenv/
[23:18:55] <dstufft> Ivo: I think virtualenv might have been like that for awhile, but in general rst endering changed everywhere on PyPI and uses readme now
[23:19:09] <dstufft> you check what the actual failures are by running pip install readme && python setup.py check -r -s
[23:20:04] <dstufft> (that doesn't yet take into account "soft" failures, like "you used an element that PyPI is going to escape so it's not going to render correctly", but it will take into account any rst failures)
[23:25:19] <r1chardj0n3s> huh, dstufft, just running the nested nuker, and a bunch of the nester files are missing. I wonder whether people are finally going in and trying to nuke their own nester projects, but only nuking the files and the db leaves broken file references?
[23:31:17] <r1chardj0n3s> ah dstufft, no, it was your file-removal change (retaining the file names) that is the issue :) no worries though
[23:59:48] <r1chardj0n3s> ionelmc: I noticed them start to appear back when the book was first published, a few years back. Wrote a script to nuke them. Including the German translation :/