> being "hard" to force on devs.

Because there's a long history of people using cooperation and responsibility in PyPI, and don't have your pressing need to change. Not because they are lazy, but because they don't care about your personal needs.

Some only upgrade every few years. For me, it seems like the PyPI upload process changes faster than my release cycle.

Somehow you you think that long tail of distributors - not "packages with millions of users" because they had to switch to 2FA a couple years ago, but packages with perhaps 50 users - will jump to 2FA within a couple of years?

Calling them lazy certainly doesn't help encourage transition.

> I'm not a giant corp

So you entered the Python ecosystem without knowing fully how it works (understandable), didn't find that it meets your requirements (understandable) and decided to place the blame squarely on other people. By calling them out as "lazy."

Thing is, "lazy" can be turned around on you too.

Sounds like you were too lazy to figure out the problems with Python before you got stuck with it. You should have researched it first - then you could have gone to some other language.

Of course, the real issue is that you learned things over time, and it's hard to switch at this point.

Just like PyPI.

> too lazy to have some actual security around their release process

If they haven't updated in 4 years, what's the difference to you? You really think everyone is releasing all their packages all the time, and as on the ball as you are?

> back to the actual source commit. Which, it often isn't!

What arrogant presumption! It's free software. You paid nothing, so you're already getting more than you paid for. While at the same time you are making money from their work.

Your attitude, repeated over and over, is causing open source project maintainers to burn-out.

You want that? You pay for it, or pay someone else to do it for you, or do it yourself.

I don't develop open source now because of the attitude of people like you.

> but that's in poor taste

To strong contrary. PyPI devs must balance between the needs of corporate and professional users like you, and student and hobbyist programmers who don't care about "real security" but have something they want to publish, and only touch every few years.

Make the barrier too high, and they drop out, just like the enclosure laws to the actually-well-managed commons in England.

Sure, perhaps you want a market floor meant only for corporate and professional accounts. But I know that's not what the PyPI devs want because I've heard them talk about it.

Make the barrier too high, and people will migrate to alternate providers. It's easy to set up a 'simple' PyPI server - I have a static one for my software releases since I'm tired of dealing with PyPI changes when I just want to update via rsync/ssh.

But you know what? Pip and other programs do a really bad job of isolating packages between multiple servers. I can see pip checking my server for "pip" updates, and I can see someone tried to install "numpy" from my server. I could easily have given them a fake one.

The PyPI devs can't easily change how that protocol works, plus namespace conflicts become even worse with multiple providers, so they really do not want to encourage a migration to other systems.

Move to another programming language with a distribution security model that meets your high standards. Don't stay with Python - you'll be hating it for your entire career.