#Pypi

Despite hallucinations, I now prefer to search #pypi using #ChatGPT - Pypi has relevancy ranking, but has a lot of trash (incomplete packages immediately abandoned) and #ChatGPT seems to do a good job of steering me away from trash.

You know what would be nice? Having to opt into downloading a pypi package from any account that is less than 12 months old. This would kill typosquatting & give malicious package detectors enough time to find the bad before people install by accident.

#pypi #python

I like searching for #pypi packages with #ChatGPT, you get

Useful packages that
- Do exist
- Exist and didn't use a single key word you typed & are relevant
- Could exist
- Should exist
- Exist in a better universe

Pypi search only returns substring matches sorted some relevancy score

#pypi it would be a nice feature to do have pypi do authenticated installs so pypi could report back to people when a package was yanked for security purposes. (Yeah, that could be a lot of data)

#python

#python

private #pypi repos are security foot guns.

https://www.youtube.com/watch?v=fWquXVcTKjU

---
The self-asserted "Development Status" on #pypi is a mess:
- Anything below beta should only be on testpypi.
- Inactive & Mature are passage of time things, no need to do a release to express that
- Anything below "stable" is subjective noise.

ref: https://martin-thoma.com/software-development-stages/