pypa/pip — pull request #1098 by dstufft (2013-07-29 15:38:25+00:00)
Title: Remove direct support for PEP381 Mirrors

* PEP381 Mirroring support was never fully implemented leaving users of it trivially exploitable to a MITM or malicious mirror operator.
* 2 out of 6 of the mirrors have been removed from the pool and will never resolve.
* The remaining mirrors often fall behind
* The mirrors will likely never be available under HTTPS
* People who wish to use a mirror of PyPI can still do so by manually specifying a mirror url for --index or --extra-index-url which is imminently more flexible allowing for mirrors to be hosted under any domain.

Additionally Richard has proposed (and I agree with him) demphasizing (and ideally removing) the official public mirrors as they are now more or less superseded by the CDN as well as being a security risk for PyPI itself (an attacker controlling z.pypi.python.org can attack the cookies from pypi.python.org).