Not very keen that the whole story of trust is basically centralisation - requiring "big cloud" and essentially promoting lock-in.

Did I get that right? Seems a bit anti-pythonic.

▲

duskdozer 2 hours ago | parent | next [-]

I think at this point the group of devs+ who are not fully on board with control by and dependence on big tech/VC is a small niche unfortunately.

▲

125ajh 2 hours ago | parent | prev | next [-]

You got that right. In this thread we have a ClosedAI employee promoting ClosedID services. Look at the sponsors of ClosedID:

https://openid.net/foundation/sponsoring-members/

We know why PyPI ripped out PGP support and has refused any verification mechanisms that other distributions use for decades.

▲

cozzyd 2 hours ago | parent | next [-]

I trust myself way more to with with a pgp key on my computer than figuring out how to use GitHub actions properly...

	▲	theteapot an hour ago \| parent [-]
		The problem is no one else does. Github workflow is at least public and auditable. Your personal computer is not.

▲

bbor an hour ago | parent | prev [-]

1. "ClosedAI" is not gonna win people over to your side, IMHO. Apple doesn't plant trees, Microsoft makes big hardware, and Python is not satanic.

2. I'm not entirely sure what the link is supposed to prove -- would appreciate a word of clarification if you find the time. It almost feels like a dogwhistle of some kind, but A) I doubt anyone on HN is anywhere near that problematic, and B) there's no clear pattern in those companies other than "interested in ID tech", and none of the usual dogwhistle targets made the list. Also, y'know, OpenAI isn't on it...?

I guess my fundamental confusion isn't about the list and more about what "we know". Are you implying that they are against pure, unmanaged PGP for this system because... I mean, why? Because they're playing the long game to promote a verification/attestation/identification (?) technology that you think offers less stringent privacy guarantees, and thus to sell more ads in 2036?

If so, doesn't that seem like a kinda roundabout way to raise Display Ads revenue, otherwise known as "that one dying industry"?

▲

asdg164 11 minutes ago | parent [-]

No one understands your dogwhistle ramblings. You are just shooting down a comment with about 20 strawmen to muddy the waters.

	▲	bbor a few seconds ago \| parent [-]
		Are... are you creating new hackernews accounts for every comment? Why? Anyway, sorry to confuse/frustrate, I was being honest and tried to explicitly not accuse you of dogwhistling. I was making a best-effort attempt to explain my confusion, rather than just replying with "that doesn't make any sense" or something. I guess I'll briefly elaborate just in case: "dogwhistle" above refers to a specific kind of antisemetic practice where people point at a list of companies or institutions or even just people and say something like "what do you notice?", whith the message ofc being that they're all related-to/run-by Jewish people. Again, not accusing you of that -- those people don't generally come here. But absent any other logic, I am left with confusion. I will briefly add that this very response also doesn't help, when you very clearly imply that I am "shooting down a comment" in bad faith for some sinister purpose. It, again, comes off as conspiratorial. Why would I --a sad 30 y/o child with my real name and phone number in my bio-- be shooting this down? I guess my overall response is that this feels like a conspiracy theory without identifying the conspiracy.

▲

bbor an hour ago | parent | prev [-]

It's anti lots of things, but I don't think it's anti-Pythonic. Python is about pragmatism & empathy if it's about anything -- bitcoin and such don't factor into it. See: Astral/OpenAI, Anaconda, most of the PSF board historically being employees of big corporate users of python, NVidia's relation to the ecosystem in general, etc.

As a passionate anarchosyndicalist, I, for one, am thrilled about it. Decentralization is a tool in our toolbox for identifying and dismantling unjust hierarchies, but it is not a panacea, and can be quite damaging when taken to the extreme. See: cryptocurrency speedrunning 200y of bank regulations in 20y.

To put my trust for Python in more concrete terms: they support GitLab. As a passionate GitLab shill, I really couldn't be more impressed! It continues to shock me how infrequently the second most popular forge is acknowledged, much less supported. This shows they're not just, IDK, bowing to Microsoft's demands.

	▲	woodruffw 35 minutes ago \| parent [-]
		> This shows they're not just, IDK, bowing to Microsoft's demands. Not only don't we, but I must emphasize that Microsoft did not pay for anything involving the implementation of either Trusted Publishing or attestations on PyPI. I wrote a personal blog post explaining some of my own rationale for why we prioritized GitHub and GitLab for PyPI's initial support targets, and it shouldn't be surprising to anybody who knows me that the reasons are pragmatic, not dogmatic[1]. [1]: https://blog.yossarian.net/2024/11/18/Security-means-securin...