[alsodumb]

Given how widespread PyPI usage is, I'm surprised they only have one full time security staff. I mean I guess it makes sense, usage doesn't always mean they get more donations/money, but damn.

[spencerchubb]

companies that actually care about security have a more secure solution and don't allow devs to use pypi

[cjalmeida]

You’d be surprised by the amount of companies handling critical infrastructure that are OK with using PyPI directly

[f1shy]

For example we have it behind a kind of transparent proxy, where you get only packages which were tested and scan by a team of experts.

[davidshepherd7]

Could you give some examples of more secure solutions?