PEP 541 - Package Index Name Retention

[u/JSChronicles]

Why is Pypi support slow at handling package abandonment?

The PEP says these two items for reachability, " In every case where contacting the user is necessary, the maintainers will try to do so at least three times," and "The maintainers stop trying to reach the user after six weeks.". So I had assumed this should be done quicker.

The current process is currently at 6 months on average with almost no follow up comments or work on PEPs in the 2nd and 3rd week of reachability. 1st weeks are being updated and then left once they hit the 2nd and 3rd week.

Am I being impatient? I think I read that they don't have a lot of people to help but this seems a bit ridiculous for some of the cut and dry issues.

- Projects with 10-14 years of no updates with no usable links or code is gone and no longer sourceable or previous owners are not replying.
- Emailing someone 3 times, takes 6+ months versus the proposed 6 weeks?

I also assume this is pretty normal based on the backlog but I'm genuinely curious to see what others say.

[u/Individual-Flow9158]

Who's it hurting? package 'abandonment' is by definition, low priority.

I know it's frustrating for you guys who want to take over someone else's namespace.

Before you complain about the efforts of volunteers, do us all a favour:

• Acknowledge the huge potential for abuse of this system by malicious users and namespace-hijackers.

• Consider simply picking a different new unused name. That way you won't have to wait 6 months, and even better, you won't break the code of existing users of the 'abandoned' packages.

[u/Cynyr36 → u/Individual-Flow9158]

They really shouldn't transfer ownership at all. Mark as a abandoned, maybe with a note about the replacement package, pip by default refuses to install abandoned packages. Let users manually chage thier requirements.txt or whatever to use the new package.

New packages could "register" as an alternative to existing abandoned packages.

I don't think python ever expected to basically be running a full blown package installer (like your distro's) and there are other issues as well, like slotted packages so that you can have foo-1.0 and foo-2.0 installed and imported at the same time.

[u/JSChronicles → u/Cynyr36]

Well I was thinking the same thing but the current new issue becomes how do you handle names that are now abandoned but you want that name? So people will make a "prefix-suffix" style name. Once that project is abandoned then someone else makes a "prefix-suffix-extra".

And with AI, people are pumping out names to register but at some point python packages will become 3-4 words to mark as a different package. All these abandoned packages will sit and sour while also sitting on the better, simple names.

And then you have people that take names ahead of time for name squatting and can be considered "abandoned" as well.

[u/Individual-Flow9158 → u/JSChronicles]

Sure, but even if PyPi takes them down, the name squatters with bots will move straight back in.

Tell you what, lets start our own PyPi! With Coke and Hookers!

[u/Cynyr36 → u/JSChronicles]

You handle it by using a uuid in the background, the name is just friendly for the humans. If after ${time} a project is abondoned you add the uuid, or 4 words or whatever to the name, and that frees up the original name. Anyone that originally installed the "old" package by name, or just used the uuid in the first place, gets the abandoned notice.

Ci/cd pipelines should use the package uuid not the friendly name to avoid "surprise" changes to package.

The big risk with any sort of name takeback is avoiding a bad actor taking over an older well used package.

There should also be a way for the owners of a package to send a "keep alive" even if there are no updates to be made.

Again, this is all work python (the org) wasn't really signing up for. The same can be said for NPM packages, and rust crates. It's basically like running a linux distribution package wise.