<html><head><style>body{font-family:Helvetica,Arial;font-size:13px}</style></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">On July 24, 2014 at 8:23:59 AM, Stefan Krah (<a href="mailto:stefan@bytereef.org">stefan@bytereef.org</a>) wrote:</div> <div><blockquote type="cite" class="clean_bq" style="color: rgb(0, 0, 0); font-family: Helvetica, Arial; font-size: 13px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);"><span><div><div></div><div>Richard Jones <r1chardj0n3s@gmail.com> wrote:<span class="Apple-converted-space"> </span><br>> There still remains the usability issue of unsophisticated users running into<span class="Apple-converted-space"> </span><br>> external indexes and needing to cope with that in one of a myriad of ways as<span class="Apple-converted-space"> </span><br>> evidenced by the PEP. One solution proposed and refined at the EuroPython<span class="Apple-converted-space"> </span><br>> gathering today has PyPI caching packages from external indexes *for packages<span class="Apple-converted-space"> </span><br>> registered with PyPI*. That is: a requirement of registering your package (and<span class="Apple-converted-space"> </span><br>> external index URL) with PyPI is that you grant PyPI permission to cache<span class="Apple-converted-space"> </span><br>> packages from your index in the central index - a scenario that is ideal for<span class="Apple-converted-space"> </span><br>> users.<span class="Apple-converted-space"> </span><br><br>-1. That is unlikely to solve the draconian-terms-and-conditions problem<span class="Apple-converted-space"> </span><br>and one reason to host externally is to get your own download statistics.<span class="Apple-converted-space"> </span></div></div></span></blockquote></div><p>The ToS is not draconian, it is a minimal ToS which allows PyPI to function.</p><p>If people want/need additional stats we can add them to PyPI. This is on the TODO list anyways.</p><div><div><blockquote type="cite" class="clean_bq" style="color: rgb(0, 0, 0); font-family: Helvetica, Arial; font-size: 13px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);"><span><div><div><br><br><br>> Organisations not wishing to do that understand that they're the ones<span class="Apple-converted-space"> </span><br>> causing the pain for users.<span class="Apple-converted-space"> </span><br><br>No. First, checksummed external packages could be downloaded without asking<span class="Apple-converted-space"> </span><br>at all. Second, if international authors are required to study US export law<span class="Apple-converted-space"> </span><br>before uploading, I wonder who is causing the pain.<span class="Apple-converted-space"> </span></div></div></span></blockquote></div><p>With PEP 470 you are not required to study anything nor upload to PyPI, if you wish to host outside of PyPI you simply host an external index, which is as simple as a plain html file with links to the downloadable files.</p><div><blockquote type="cite" class="clean_bq" style="color: rgb(0, 0, 0); font-family: Helvetica, Arial; font-size: 13px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);"><span><div><div><br><br>Finally, how can an author cause pain for users? Without him, the work<span class="Apple-converted-space"> </span><br>would not be there in the first place.<span class="Apple-converted-space"> </span><br><br></div></div></span></blockquote><div><br></div><div>I’m not quite sure how to answer this. It’s quite obvious that an author’s choices can cause pain for a user. For example, the author could have an option where if specified it silently deleted the entire filesystem of the user. This would be incredibly painful for the end user (assuming they didn’t want that of course).</div><div><br></div><div>Now a project is owned by the author, so they are allowed to choose to do things which cause pain for end users, and end users get to make a choice about whether it’s worth using that project even with the pain incurred from the author’s choices. The reason we don’t download checksummed external packages by default any more is because they *do* represent a choice that causes pain for end users and thus users should be aware they are making that choice.</div><br><blockquote type="cite" class="clean_bq" style="color: rgb(0, 0, 0); font-family: Helvetica, Arial; font-size: 13px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);"><span><div><div><br>Stefan Krah<span class="Apple-converted-space"> </span><br><br><br>_______________________________________________<span class="Apple-converted-space"> </span><br>Distutils-SIG maillist - Distutils-SIG@python.org<span class="Apple-converted-space"> </span><br>https://mail.python.org/mailman/listinfo/distutils-sig<span class="Apple-converted-space"> </span><br></div></div></span></blockquote><br class="Apple-interchange-newline"></div><br class="Apple-interchange-newline"></div> <div id="bloop_sign_1406216538076994048" class="bloop_sign"><div style="font-family:helvetica,arial;font-size:13px">-- <br><span style="font-family: helvetica; line-height: normal;">Donald Stufft</span><br style="font-family: helvetica; line-height: normal;"><span style="font-family: helvetica; line-height: normal;">PGP: 0x6E3CBCE93372DCFA // 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA</span></div></div></body></html>