# PyPI Q4 RFI

**URL:** https://discuss.python.org/c/python-software-foundation/pypi-q4-rfi/18.md

[Latest](https://discuss.python.org/latest.md) · [Categories](https://discuss.python.org/categories.md) · [Tags](https://discuss.python.org/tags.md)

---

## [About the PyPI Q4 RFI category](https://discuss.python.org/t/about-the-pypi-q4-rfi-category/2225)

<div class="topic-metadata">

**Author:** [@EWDurbin](https://discuss.python.org/u/EWDurbin)\
**Replies:** 1\
**Last updated:** [September 3, 2019, 2:42pm UTC](https://discuss.python.org/t/about-the-pypi-q4-rfi-category/2225 "2019-09-03T14:42:22Z")

</div>

Closed: Discussions related to the 2019 Q4 PyPI Request For Information published at https://github.com/python/request-for/blob/master/2019-Q4-PyPI/RFI.md

---

## [Interoperability concerns](https://discuss.python.org/t/interoperability-concerns/2227)

<div class="topic-metadata">

**Author:** [@sumanah](https://discuss.python.org/u/sumanah)\
**Replies:** 2\
**Last updated:** [September 19, 2019, 8:52pm UTC](https://discuss.python.org/t/interoperability-concerns/2227 "2019-09-19T20:52:08Z")

</div>

Continuing the discussion from Prerequisites & vetoes – improving packaging security about future work on end-to-end signing: @steve.dower raised a question, saying: so I want to check: Steve, this RFI will help us ch…

---

## [Detect when a package's behavior drastically changes](https://discuss.python.org/t/detect-when-a-packages-behavior-drastically-changes/2315)

<div class="topic-metadata">

**Author:** [@fbidu](https://discuss.python.org/u/fbidu)\
**Replies:** 5\
**Last updated:** [September 19, 2019, 8:52pm UTC](https://discuss.python.org/t/detect-when-a-packages-behavior-drastically-changes/2315 "2019-09-19T20:52:02Z")

</div>

This is more of a thought I entertained a few days ago than a formal proposal. Some supply-chain attacks had a common pattern - a package started uploading data all of a sudden. I think that if we could track that a pack…

---

## [Which cryptographic signing approach?](https://discuss.python.org/t/which-cryptographic-signing-approach/2241)

<div class="topic-metadata">

**Author:** [@sumanah](https://discuss.python.org/u/sumanah)\
**Replies:** 33\
**Last updated:** [September 19, 2019, 8:51pm UTC](https://discuss.python.org/t/which-cryptographic-signing-approach/2241 "2019-09-19T20:51:57Z")

</div>

We want verifiable cryptographic signing of artifacts. PEP 458 (“Surviving a Compromise of PyPI”) and PEP 480 (“Surviving a Compromise of PyPI: The Maximum Security Model”) were authored to propose implementation of The…

---

## [Questions about PEP 458 / 480](https://discuss.python.org/t/questions-about-pep-458-480/2352)

<div class="topic-metadata">

**Author:** [@LucidOne](https://discuss.python.org/u/LucidOne)\
**Replies:** 6\
**Last updated:** [September 19, 2019, 8:51pm UTC](https://discuss.python.org/t/questions-about-pep-458-480/2352 "2019-09-19T20:51:52Z")

</div>

From the other thread…

---

## [What methods should we implement to detect malicious content?](https://discuss.python.org/t/what-methods-should-we-implement-to-detect-malicious-content/2240)

<div class="topic-metadata">

**Author:** [@sumanah](https://discuss.python.org/u/sumanah)\
**Replies:** 23\
**Last updated:** [September 19, 2019, 8:51pm UTC](https://discuss.python.org/t/what-methods-should-we-implement-to-detect-malicious-content/2240 "2019-09-19T20:51:38Z")

</div>

Let’s discuss here: what methods should Warehouse use to detect malicious content? Some relevant GitHub issues: #5117 and (on typosquatting specifically) #4998.