PyTorch and the PyPI supply chain

Split PyPI into two - a curated part and a non-curated part - and you might as well have distributions doing a competent job of curation on a subset of packages. There's a reason that some of us have used distributions for >25 years and look on non-curated software with amusement and horror.

And yes - I'm frankly amazed how many language / package distribution mechanisms for various operating systems have effectively reimplemented apt poorly.