"Only recently" is deceptive and either needs to be expanded or there needs to be a footnote explaining what that even means. Expecting people to read a bpo issue to try to determine when it stopped does not seem reasonable to me. Further, not using HTTP simply isn't enough to make distutils secure.

"Only recently" is deceptive and either needs to be expanded

I thought the Versions field of the linked bugreport would be informative enough while not distracting the user from twine's rationale. I have updated the whole paragraph though.

Further, not using HTTP simply isn't enough to make distutils secure.

I didn't write that anywhere. Even the commit message doesn't, although I tried hard to keep that line within 50 chars.

We should probably also say "easily sniffed" because there's no verification of the connection and someone using a tool like mitmproxy could easily sniff the credentials over TLS that is not verified.

there's no verification of the connection

Are you saying that twine doesn't check SSL certificates?

Are you saying that twine doesn't check SSL certificates?

No. distutils (even thought it uses HTTPS) does not check SSL certificates. Twine does.

Sorry, brainfart. Will fix.

Just did s/sniffed/easily sniffed/g.