> that's like suggesting someone complaining about security issues should fork libxml or openssl because the original developers don't have enough resources to maintain their work.

I disagree with this analogy, both those libraries have complex and nuanced implementation details which make forking difficult to work in a compatible way. PyPI does not, you can host a simple index with existing libraries and have 100% compatibility with all Python package installer tools.

And YET, openssl has been forked by companies a bunch of times exactly because it lacks resources to do significant security analysis of it's own code.

> for pypi that means raising funds that we can contribute to.

PyPI accepts funds, feel free to donate.

> so instead of arguing that the PSF doesn't have the resources, they should go and raise them. do some analysis on what it takes, and then start a call for help/contributions. to get started, all it takes is to recognize the problem and put fixing it on the agenda.

This is all already being done, it appears like you haven't done any research into this before commenting on this topic.