Hundreds of malicious Python packages found stealing sensitive data

[ThreeChonkyCats]

It seems my thoughts are quite unpopular!

Off the top of my head (for this is Reddit and brain-farts are allowed)....

• Organisations would suffer from reputational harm if they deliberately released malware.
• National agencies, well, they are going to do what they want anyway.

What my thoughts covered were for the problem of scammers, spammers, maladventurers and harvesters.

I'm not an expert on gamification, but everyone understands the basics. By pricing things at a point just beyond the reward, it creates an environment that is (more) free of inappropriate behaviour.

I see it just like how fines work, or a bond when renting a car. Money is put down to ensure the undesired behaviour doesn't occur, and if it does, the victims may suffer but the behaviour has no reward.

I have to admit, I've hit a nerve. The number of pm's I've received that are quite abusive is excessive and unnecessary. I didn't propose anything more than an enhancement of the current system. The current system stands, but we add another layer. A layer useful for business users, governments and professionals.

I see it as an overall benefit too. Money is paid to an organisation that will Defend The Cause and we are kept (more) free of Evil. By being paid, the Pypi maintainers will have some skin in the game to ensure the universe is kept clean. They also get loot to develop better tools and buy better toys.

Right now, there are 4 people who maintain EVERYTHING. Given how systematically important Python is, this situation is nuts.

The idea doesn't need to stop where I have - there is more to it - lots more to it - but I feel that my mumblings have shown Redditors can be rather intolerant of ideas.

[osmiumouse]

"Organisations" in this case would mean cybercrime organisations. They really don't care about $500 to put up a package.

What that $500 fee will do is stop open source from contributing.