The Python Software Foundation, earlier this year, successfully obtained a
$1.5˙million grant from the US National Science Foundation "to
address structural vulnerabilities in Python and PyPI". The actual
grant came with some strings attached though, in the form of a requirement
not to pursue diversity, equity, and inclusion programs. So the Foundation
has withdrawn
the proposal rather than agree to terms that run counter to its own
mission.
We're disappointed to have been put in the position where we had to
make this decision, because we believe our proposed project would
offer invaluable advances to the Python and greater open source
community, protecting millions of PyPI users from attempted
supply-chain attacks. The proposed project would create new tools
for automated proactive review of all packages uploaded to PyPI,
rather than the current process of reactive-only review.
https://lwn.net/Articles/1043563/
--- SBBSecho 3.29-Linux
* Origin: Palantir * palantirbbs.ddns.net * Pensacola, FL * (86:200/23)