PyPI now checks for expired domains to prevent domain resurrection attacks, a type of supply-chain attack where someone buys an expired domain and uses it to take over #PyPI accounts through password resets. #Python#OpenSource#SupplyChain#Security
https://blog.pypi.org/posts/2025-08-18-preventing-domain-resurrections/
Discussion
Loading...
Discussion
@pypi And what is a "custom domain name"? Why a special privilege for gmail.com?
@bortzmeyer @pypi Because not all #TLD registries joined the #RDAP fiesta 🙂 ? And in theory even a change of registrant, or maybe even DNS provider (or MX records) should trigger a "emails on this domain are not verified anymore" situation. As it should trigger certificates revocation too, which won't happen (hence shorter lifetimes as a solution).
@bortzmeyer @pypi So either they forbid people using email addresses in ccTLDs (bad and probably not the case), or they consider that population to be more well-behaved regarding domain zombies (as they resurrect…) 🙂
bonfire.cafe
A space for Bonfire maintainers and contributors to communicate
Automatic federation enabled