Codeberg win

In short: Money

Long story: Legacy

The really long story: They added a bunch of stuff in that version and it's the last LTS before they removed a bunch of other stuff and a lot of companies are just too lazy to update their 10 year old crappy software.

The end.

But they were, all of them, deceived

For another format was made.

we

1. Why AI?
2. Why in retarded units?
3. Why is the data incorrect? "In fact, a coyote's fastest sprinting speed is 64 km/h (40 mph), which is twice that of a roadrunner's at 32 km/h (20 mph)."

I'm having no problems with donating to OSS projects, yet what always prevents me from doing so is when such projects are not transparent where my donation money actually goes.

Yet, the average donations we receive are around 100 euros per month. A sum that doesn’t even cover server costs or the resources we use.

Well, I see no linked explanation where this money goes or why the server costs are so high, which is immediately a red flag for me.

Can't wait for all the other horror stories getting posted here :D

I also personally ask myself how a PyPI Admin & Director of Infrastructure can miss out on so many basic coding and security relevant aspects:

• Hardcoding credentials and not using dedicated secret files, environment variable or other secret stores
• For any source that you compile you have to assume that - in one way or another - it ends up in the final artifact - Apparently this was not fully understood (".pyc files containing the compiled bytecode weren't considered")
• Not using a isolated build process e.g. a CI with an isolated VM or a container - This will inevitable lead to "works on my machine" scenarios
• Needing the built artifact (containerimage) only locally but pushing it into a publicly available registry
• Using a access token that has full admin permissions for everything, despite only requiring it to bypass rate limits
• Apparently using a single access token for everything
  • When you use Git locally and want to push to GitHub you need an access token. The fact that article says "the one and only GitHub access token related to my account" likely indicates that this token was at least also used for this
• One of the takeaways of the article says "set aggressive expiration dates for API tokens" - This won't help much if you don't understand how to handle them properly in the first place. An attacker can still use them before they expire or simply extract updated tokens from newer artifacts.

On the other hand what went well:

• When this was reported it was reacted upon within a few minutes
• Some of my above points of criticism now appear to be taken into account ("Takeaways")

So just for additional context:

This meme was brought to you by the following API response scheme:

{
  "time": "2007-12-24 18:12",
  "servertimezone": "Europe/Vienna",
  "timezoneoffset": -8
}

when it could have just been

{
  "date": "2007-12-24T18:21:00-07:00"
}