"PyPI should be considered a supply chain risk until the PSF is able to hire more engineering staff."
https://pyfound.blogspot.com/2026/08/how-aws-powers-pypi-and-psf.html
2
Replies
3
Boosts
RE: https://mastodon.social/@andrewnez/117128355243322772
@andrewnez that phrasing came off more alarmist than we intended, so we've revised it. The risk isn't PyPI itself, but the gap in resources: The PSF needs more support to keep up the same high bar of service and quality as demand grows.
We encourage companies who rely on PyPI to financially support our security work for everyone's benefit.
i've adjusted the wording to clarify!
https://github.com/pypi/warehouse/commit/bc867eed
@andrewnez to the point that we’re discussing infinitesimal calculus
