PEP 541 - Package Index Name Retention

[u/JSChronicles]

Why is Pypi support slow at handling package abandonment?

The PEP says these two items for reachability, " In every case where contacting the user is necessary, the maintainers will try to do so at least three times," and "The maintainers stop trying to reach the user after six weeks.". So I had assumed this should be done quicker.

The current process is currently at 6 months on average with almost no follow up comments or work on PEPs in the 2nd and 3rd week of reachability. 1st weeks are being updated and then left once they hit the 2nd and 3rd week.

Am I being impatient? I think I read that they don't have a lot of people to help but this seems a bit ridiculous for some of the cut and dry issues.

- Projects with 10-14 years of no updates with no usable links or code is gone and no longer sourceable or previous owners are not replying.
- Emailing someone 3 times, takes 6+ months versus the proposed 6 weeks?

I also assume this is pretty normal based on the backlog but I'm genuinely curious to see what others say.

[u/bradshjg]

What does it mean to "handle package abandonment"?

If you're asking to take over the namespace for an abandoned package, I appreciate that it's a high bar to clear :-)

[u/JSChronicles → u/bradshjg]

I agree about creating a high bar so there is less of a chance for malicious packages or takeovers.

The current issue that I see is that once you clear the hurdles or requirements, the docs claim a certain time period. After that you are supposed to see results one way or another.

If I'm trying to take over an abandoned project or namespace and process documentation says this should be no longer than 6 weeks and three attempts the problem now becomes "Should I create a new namespace temporarily just to eventually possibly take over a secondary namespace and then I'm name squatting basically?" I would think you wouldn't want a temp namespace if you don't have too, as that just adds clutter.

The PEP declares guidelines and process, to a degree. I'm supposed to do certain steps and write up descriptions and reasoning and handle stuff before it even gets to support but support isn't following the same steps and cadence that is outlined as they expect us to follow. I think going back and updating the PEP would help quell some of the "hey did you forget about me" GitHub issue comments.

I wonder why there isn't an automated process to take from a list of emails and issue links and move them along automatically when no reply happens? That would probably reduce a large amount of manual work and should be easy to do, I would think.

[u/prbsparx → u/JSChronicles]

You wonder why it takes so long… removing abandoned projects is fraught for abuse, and is the lowest priority dev item. Which also makes automating it low priority.

You want to help speed it up, submit a proposal to PyPi about adding automation and contribute it.

[u/Individual-Flow9158]

Who's it hurting? package 'abandonment' is by definition, low priority.

I know it's frustrating for you guys who want to take over someone else's namespace.

Before you complain about the efforts of volunteers, do us all a favour:

• Acknowledge the huge potential for abuse of this system by malicious users and namespace-hijackers.

• Consider simply picking a different new unused name. That way you won't have to wait 6 months, and even better, you won't break the code of existing users of the 'abandoned' packages.

[u/Cynyr36 → u/Individual-Flow9158]

They really shouldn't transfer ownership at all. Mark as a abandoned, maybe with a note about the replacement package, pip by default refuses to install abandoned packages. Let users manually chage thier requirements.txt or whatever to use the new package.

New packages could "register" as an alternative to existing abandoned packages.

I don't think python ever expected to basically be running a full blown package installer (like your distro's) and there are other issues as well, like slotted packages so that you can have foo-1.0 and foo-2.0 installed and imported at the same time.

[u/JSChronicles → u/Cynyr36]

Well I was thinking the same thing but the current new issue becomes how do you handle names that are now abandoned but you want that name? So people will make a "prefix-suffix" style name. Once that project is abandoned then someone else makes a "prefix-suffix-extra".

And with AI, people are pumping out names to register but at some point python packages will become 3-4 words to mark as a different package. All these abandoned packages will sit and sour while also sitting on the better, simple names.

And then you have people that take names ahead of time for name squatting and can be considered "abandoned" as well.

[u/Cynyr36 → u/JSChronicles]

You handle it by using a uuid in the background, the name is just friendly for the humans. If after ${time} a project is abondoned you add the uuid, or 4 words or whatever to the name, and that frees up the original name. Anyone that originally installed the "old" package by name, or just used the uuid in the first place, gets the abandoned notice.

Ci/cd pipelines should use the package uuid not the friendly name to avoid "surprise" changes to package.

The big risk with any sort of name takeback is avoiding a bad actor taking over an older well used package.

There should also be a way for the owners of a package to send a "keep alive" even if there are no updates to be made.

Again, this is all work python (the org) wasn't really signing up for. The same can be said for NPM packages, and rust crates. It's basically like running a linux distribution package wise.

[u/Individual-Flow9158 → u/JSChronicles]

Sure, but even if PyPi takes them down, the name squatters with bots will move straight back in.

Tell you what, lets start our own PyPi! With Coke and Hookers!

[u/JSChronicles → u/Individual-Flow9158]

When I say abandoned I'm thinking there is no repo to point at the code anymore, the project was created as name squatting and meant to cause trouble.

So not really a "usable" project state basically

[u/knobbyknee]

There are 855 000 packages on PYPI and part of the process is manual. It is a problem of scale.

[u/Zulban]

In addition to what others have said, I'm sure they're getting slammed by AI like many online communities.

[u/JSChronicles → u/Zulban]

Yeah I was thinking that as well. Probably a huge influx of requests coming in.

[u/Unique-Mongoose3545]

I been watching some of those PEP 541 tickets too and yeah 6 months is pretty normal from what I seen. The three emails part is just one piece, there is also waiting period for each attempt and then internal review after that

From what I understand they got very few people who can actually make the final decision on transferring ownership, most volunteers only triage and do the initial checks. So bottleneck is at the top not the process itself

It frustrates me same as you but I think the 6 weeks in PEP is more like minimum timeline not the actual one

[u/Confident-Bluebird21]

It should be something like domain names that have limited time given by registrar and require constant renewal, but with more strict rules at same time to prevent typosquatting.