Is "a public key that I personally upload to my PyPI account, using the credentials you already have that allow me to use that account" on the list of targets that will ever be supported?
replyIf not--i.e., if only recognized "forges" are ever going to be supported--why not?
https://news.ycombinator.com/item?id=50499442 Seems relevant here.
replyThanks, I'll comment further in that subthread.
replyAll absolutely reasonable. At the same time though there are a lot of roads leading to centralisation, and as they all converge it gets just a bit .. problematic.
replyAbsolutely not claiming its not a pragmatic step, but equal-footing alternatives would be useful.
I'm no tin-foil-hat - but when a website account requires government id (like in the uk), and creating software requires signing by the website, you link all the things - is that a good outcome?
This is true, and it’s why I’m hopeful that some of the newer forges can make meaningful default posture improvements that make migration away from centralized services the dispassionate choice to a user who cares about availability and security.
replyThanks for the link - your blog is great! eg https://blog.yossarian.net/2026/04/11/Brocards-for-vulnerabi...
reply