News for hackers. Stuff that matters.

A comment on Malicious software libraries found in PyPI posing as well known libraries. Parent comment

Re:Malicious software libraries found in PyPI posing as well... by donaldstufft on Friday September 15, 2017 @05:06PM (#15260779)
> Herd immunity. Someone is out there reviewing it.

More likely everyone assumes someone else is reviewing it, and nobody actually does.

[ Parent | on HN ]
Re:Malicious software libraries found in PyPI posing as well... by danjoc on Saturday September 16, 2017 @07:31PM (#15267329)
We definitely do where I work. I'm really, really surprised to hear they do not where you work. A multibillion dollar company like Amazon, who runs half the internet with AWS, does not verify dependencies? Wow. That's breathtaking.
[ Parent | on HN ]