Description
What was wrong?
- Recently Infura changed it's API to require an API key.
- There are new cloud based JSON-RPC providers showing up.
The maintenance overhead of this API is not something I'd like the core development team to end up spending their time on, but there is value in having a way for users to quickly connect to a reliable cloud based provider.
How can it be fixed?
I see two main options.
- Use something like setuptools entry_points to allow 3rd party providers to hook into the
web3
namespace so that a user would installweb3-infura
and in doing so, be able to import the web3 providers fromweb3.auto.infura.*
- Just relegate all of the cloud ones to 3rd party packages.
Downsides I see with the entry points based approach is that it makes the imports look like they come from the main web3 library when actually you're importing 3rd party code. This has the potential to mask bad actors, or worse, have malicious code insert itself masquerading as "infura" but actually doing something malicious. This is a major downside.
Because of this I'm inclined to go with option two and to deprecate our existing web3.auto.infura
imports and move them into our own web3-infura
package that we maintain. We could even go as far as providing a template for these repos to make it easier for people like nodesmith to manage their own packages.
Last, we could have a curated list of these packages listed in the docs to make them more discoverable.