Top all-time · #1737
Donald Stufft
Personal blog · caremad.ioprogrammingsystems
Donald Stufft writes caremad, a personal blog at caremad.io about programming and systems. Since 2013, 42 different Hacker News readers have linked it 54 times, most often “Why Package Signing is not the Holy Grail (2013)”. The last post was in 2018, but the archive is still widely read.
Sometimes recommended · 7 of 34 sampled comments recommend it?
Why HN links it
HN readers link Donald Stufft's blog for its posts on Python packaging: setup.py vs requirements.txt, and why package signing won't fix PyPI security. Often cited as the clearest treatment of library vs application dependencies.
- Recommended for · 7 comments
- Praised as great and insightful: the library-vs-application dependency split, and why signing won't fix packaging.
Summarised by Claude from a sample of 34 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Why Package Signing is not the Holy Grail (2013)10 people · 10 mentions · first linked 2017-09-15
- Python – setup.py vs. requirements.txt9 people · 16 mentions · first linked 2016-10-21
- A Year of PyPI Downloads7 people · 8 mentions · first linked 2015-04-21
- Python setup.py vs. requirements.txt (2013)4 people · 4 mentions · first linked 2015-03-30
- Why Package Signing Is Not the Holy Grail (2013)3 people · 3 mentions · first linked 2016-03-24
- Powering the Python Package Index2 people · 2 mentions · first linked 2016-05-15
- Blocking Compromised Passwords on PyPI2 people · 2 mentions · first linked 2018-08-15
What Hacker News says?
For people who want to do it right without using an additional tool read this: setup.py vs. requirements.txt by Donald Stufft https://caremad.io/posts/2013/07/setup-vs-requirement/
Comment linking /posts/2013/07/setup-vs-requirement/
on “Announcing Pipenv”Submitted Powering the Python Package Index as a story · 133 points
HN discussionDavid Beazley : http://www.dabeaz.com/ Kenneth Reitz : https://www.kennethreitz.org/ Armin Ronacher : http://lucumr.pocoo.org/ Julien Danjou : https://julien.danjou.info/ Hynek Schlawack : https://hynek.me/ Donald Stufft : https://caremad.io/
Comment linking /
on “Ask HN: Which developers do you closely follow?”Submitted Setup.py vs requirements.txt as a story · 64 points
HN discussionPython 3 usage doubled in the last year: https://caremad.io/2015/04/a-year-of-pypi-downloads/
Comment linking /2015/04/a-year-of-pypi-downloads/
on “Python 3.5.0”Submitted Why Package Signing is not the Holy Grail as a story · 60 points
HN discussionDepends on the use. For a library, it doesn't need to be distributed at all, since the application that's using the library will eventually dictate the actual versions of dependencies (so it can play nicely with other libraries). For an application, yes: you commit it along-side the pipfile, and re-generate the lock file when you upgrade things. https://caremad.io/posts/2013/07/setup-vs-requirement/ covers it pretty…
Comment linking /posts/2013/07/setup-vs-requirement/
on “Pipfile for Python”Submitted Blocking Compromised Passwords on PyPI as a story · 37 points
HN discussionMaybe I am missing the point, but "loose" dependencies go in setup.py, and "exact versions" go in requirements.txt. https://caremad.io/posts/2013/07/setup-vs-requirement/
Comment linking /posts/2013/07/setup-vs-requirement/
on “Pipfile for Python”Submitted Why Package Signing is not the Holy Grail (2013) as a story · 31 points
HN discussionI'm afraid I never saw what was wrong with specifying dependencies in setup.py. For me, having requirements.txt and setup.py is confusing. Can't we just stick with setup.py? (and yes, I've read Donald Stufft's post https://caremad.io/posts/2013/07/setup-vs-requirement/ and remain unconvinced).
Comment linking /posts/2013/07/setup-vs-requirement/
on “Pipfile for Python”Submitted Powering the Python Package Index as a story · 9 points
HN discussion> https://caremad.io/posts/2013/07/packaging-signing-not-holy-... Thanks, that's actually a great article that explains very well why you can't just throw signatures at the problem and claim that fixes everything. As other commenters have pointed out, the reason Maven central doesn't have this problem has nothing to do with signatures, and everything to do with the fact that all new packages must undergo manual revi…
Comment linking /posts/2013/07/packaging-signing-not-holy-grail/
on “Malicious software libraries found in PyPI posing as well known libraries”Submitted A Year of PyPI Downloads as a story · 6 points
HN discussionWhen I read things like, https://caremad.io/posts/2013/07/packaging-signing-not-holy-... I get the impression they don't care about security at all. They seem like children plugging their ears and shouting "nah nah nah" while putting repo users at risk. They've obviously done nothing since that post was made four years ago. In contrast, Maven central requires signing. Unsurprisingly, Maven central doesn't have typos…
Comment linking /posts/2013/07/packaging-signing-not-holy-grail/
on “Malicious software libraries found in PyPI posing as well known libraries”Submitted Python – setup.py vs. requirements.txt as a story · 3 points
HN discussion> You should be very conservative when pinning versions in a library, though No; you should be very conservative when pinning versions in an application, not in a library. Check this article for the explanation: https://caremad.io/posts/2013/07/setup-vs-requirement/
Comment linking /posts/2013/07/setup-vs-requirement/
on “How to make a Python package in 2021”Submitted Python setup.py vs. requirements.txt (2013) as a story · 3 points
HN discussionSigning packages works well for a linux distro. It's much less clear that it would help for a language package manager: https://caremad.io/posts/2013/07/packaging-signing-not-holy-... .
Comment linking /posts/2013/07/packaging-signing-not-holy-grail/
on “Postmortem for Malicious Packages Published on July 12th, 2018”Submitted Why Package Signing is not the Holy Grail (2013) as a story · 2 points
HN discussionThis is the difference between an "application" and a "library": https://caremad.io/posts/2013/07/setup-vs-requirement/ Libraries should absolutely not pin their dependencies. Applications should if you care about reproducible builds (not necessarily byte-for-byte, but "can build today == can build tomorrow"). Installing both libraries and applications in the same way in the same environment is a fundamental mismatc…
Comment linking /posts/2013/07/setup-vs-requirement/
on “The modern packager’s security nightmare”Submitted PyPI will no longer accept passwords that have been published in data breaches as a story · 2 points
HN discussionGPG isn't the holy grail. See https://caremad.io/2013/07/packaging-signing-not-holy-grail/ Proxying via a local dependency is a good practice, but that can be set up independently of npm.
Comment linking /2013/07/packaging-signing-not-holy-grail/
on “Changes to Npm's unpublish policy”Submitted Python: setup.py vs. requirements.txt (2013) as a story · 2 points
HN discussionFWIW, here is a blog post by dstufft which might help contextualize this behaviour: https://caremad.io/posts/2013/07/packaging-signing-not-holy-...
Comment linking /posts/2013/07/packaging-signing-not-holy-grail/
on “Backdoored images downloaded 5M times removed from Docker Hub”Submitted Python Libraries as a story · 2 points
HN discussionA very insightful look at package signing, and why it wouldn't actually improve security for PyPI, by Python packaging guru Donald Stufft: https://caremad.io/2013/07/packaging-signing-not-holy-grail/
Comment linking /2013/07/packaging-signing-not-holy-grail/
on “Vulnerability #319816 – npm fails to restrict the actions of malicious packages”Submitted Hire Donald Stufft, One of the Main Contributors to PyPI, Warehouse, and PIP as a story · 2 points
HN discussionFrom this (last year), Python 2.6 is bigger than 3: https://caremad.io/2015/04/a-year-of-pypi-downloads/ > I'm guessing that most people who use Python 3 are using recent versions of pip that have caching built in, so that may skew the results a bit. Since pip updates itself too, why wouldn't people using Python 2 also have newer versions?
Comment linking /2015/04/a-year-of-pypi-downloads/
on “PyPy 5.1 released”Submitted Distributing a CFFI Project as a story · 2 points
HN discussion
