Security, UX, and Sustainability For The Python Package Index

Summary

PyPI is a core component of the Python ecosystem that most developer’s have interacted with as either a producer or a consumer. But have you ever thought deeply about how it is implemented, who designs those interactions, and how it is secured? In this episode Nicole Harris and William Woodruff discuss their recent work to add new security capabilities and improve the overall accessibility and user experience. It is a worthwhile exercise to consider how much effort goes into making sure that we don’t have to think much about this piece of infrastructure that we all rely on.

Announcements

• Hello and welcome to Podcast.__init__, the podcast about Python and the people who make it great.
• When you’re ready to launch your next app or want to try a project you hear about on the show, you’ll need somewhere to deploy it, so take a look at our friends over at Linode. With 200 Gbit/s private networking, scalable shared block storage, node balancers, and a 40 Gbit/s public network, all controlled by a brand new API you’ve got everything you need to scale up. And for your tasks that need fast computation, such as training machine learning models, they just launched dedicated CPU instances. Go to pythonpodcast.com/linode to get a $20 credit and launch a new server in under a minute. And don’t forget to thank them for their continued support of this show!
• You listen to this show to learn and stay up to date with the ways that Python is being used, including the latest in machine learning and data analysis. For even more opportunities to meet, listen, and learn from your peers you don’t want to miss out on this year’s conference season. We have partnered with organizations such as O’Reilly Media, Dataversity, Corinium Global Intelligence, and Data Counsil. Upcoming events include the O’Reilly AI conference, the Strata Data conference, the combined events of the Data Architecture Summit and Graphorum, and Data Council in Barcelona. Go to pythonpodcast.com/conferences to learn more about these and other events, and take advantage of our partner discounts to save money when you register today.
• Visit the site to subscribe to the show, sign up for the newsletter, and read the show notes. And if you have any questions, comments, or suggestions I would love to hear them. You can reach me on Twitter at @Podcast__init__ or email [email protected])
• To help other people find the show please leave a review on iTunes and tell your friends and co-workers
• Join the community in the new Zulip chat workspace at pythonpodcast.com/chat
• Your host as usual is Tobias Macey and today I’m interviewing Nicole Harris and William Woodruff about the work they are doing on the PyPI service to improve the security and utility of the package repository that we all rely on

Interview

• Introductions
• How did you get introduced to Python?
• Can you start by sharing how you each got involved in working on PyPI?
  • What was the state of the system at the time that you first began working on it?
• Once you committed to working on PyPI how did you each approach the process of identifying and prioritizing the work that needed to be done?
  • What were the most significant issues that you were faced with at the outset?
• How often have the issues that you each focused on overlapped at the cross section of UX and security?
  • How do you balance the tradeoffs that exist at that boundary?
• What is the surface area of the domains that you are each working in? (e.g. web UI, system API, data integrity, platform support, etc.)
  • What are some of the pain points or areas of confusion from a user perspective that you have dealt with in the process of improving the platform?
• What have been the most notable features or improvements that you have each introduced to PyPI?
  • What were the biggest challenges with implementing or integrating those changes?
• How do you approach introducing changes to PyPI given the volume of traffic that it needs to support and the level of importance that it serves in the community?
• What are some examples of attack vectors that exist as a result of the nature of the PyPI platform and what are you most concerned by?
• How does poor accessibility or user experience impact the utility of PyPI and the community members who interact with it?
• What have you found to be the most interesting/challenging/unexpected aspects of working on Warehouse?
  • What are some of the most useful lessons that you have learned in the process?
• What do you have planned for future improvements to the platform?
  • How can the listeners get involved and help out?
• How was this work funded?

Keep In Touch

• Nicole
  • @nlhkabu on Twitter
  • Website
  • If you’re using CI to upload to PyPI and would like to speak with Nicole please book a time here
  • If you’re using assistive technology and would like to speak with Nicole please book a time here
• William
  • @8x5clPW2
  • Website
  • Email
  • Please get in touch if you’d like to work with Trail of Bits on your next security project!

Picks

• Tobias
  • The Expanse TV Series
• Nicole
  • The Great Hack documentary
• William
  • Abraham Lincoln Autobiography by Carl Sandburg

Links

• PyPI
• Warehouse
  • Issue Tracker
  • Good First Issues
• PeopleDoc
• Trail of Bits
• OSQuery
• Django
• Ruby
• Python Software Foundation
  • Python Packaging Working Group
  • Podcast Episode
• Donald Stufft
  • Podcast Episode
• UX (User Experience) Design
• OTF == Open Technology Fund
• Bootstrap
• TOTP
• WebauthN
• Yubikey
• Changeset Consulting
• Sumana Harihareswara
• WCAG (Web Content Accessibility Guidelines) 2.0
• Macaroon Security Tokens
• Docker Compose
• MOSS = Mozilla Open Source Support

The intro and outro music is from Requiem for a Fish The Freak Fandango Orchestra / CC BY-SA