News for hackers. Stuff that matters.

A comment on Malicious software libraries found in PyPI posing as well known libraries. Parent comment

Re:Malicious software libraries found in PyPI posing as well... by simon3 on Friday September 15, 2017 @08:34AM (#15256568)
The conda package manager is free and generally feels like a professional package manager like yum or apt-get.
[ Parent | on HN ]
Re:Malicious software libraries found in PyPI posing as well... by edraferi on Friday September 15, 2017 @10:09AM (#15257242)
Yes, Conda [0] is a package manager designed by Continuum Analytics (now Anaconda, Inc.) to support their Anaconda Distribution [1]. The distribution is free, and the Conda client is open source. However, Anaconda sells several enterprise products, including an on-premise Conda server ("Anaconda Repository").

In general, Conda does more package verification than pip, and the packages in the Anaconda distribution are more thoroughly vetted than PyPi. Conda-Forge [2] provides an escape hatch for less-vetted community code.

[0] https://conda.io/docs/index.html [1] https://www.anaconda.com/distribution/ [2] https://conda-forge.org/

[ Parent | on HN ]