Devs unknowingly use “malicious” modules snuck into official Python repository

Re:Devs unknowingly use “malicious” modules snuck into offic... by swiley on Sunday September 17, 2017 @09:38PM (#15272776)

One nice thing about languages like C is that a lot of programmers just avoid dependencies because dealing with them kind of sucks. That's one solution to this problem.

[ Parent | on HN ]

Re:Devs unknowingly use “malicious” modules snuck into offic... by freshhawk on Sunday September 17, 2017 @11:04PM (#15273098)

It is good for security research, since that introduces so many security holes of such wonderful diversity that there is a much larger ecosystem to study.

[ Parent | on HN ]

Re:Devs unknowingly use “malicious” modules snuck into offic... by sametmax on Monday September 18, 2017 @03:20AM (#15273947)

Yeah this way you reinvent a less unit tested, battle field tested and documented wheel.

It's like saying the good thing with not having a cellphone is that you avoid a lot of fight with your girlfriend cause you can't talk as much.

[ Parent | on HN ]

Re:Devs unknowingly use “malicious” modules snuck into offic... by dom0 on Monday September 18, 2017 @04:00AM (#15274105)

> It's like saying the good thing with not having a cellphone is that you avoid a lot of fight with your girlfriend cause you can't talk as much.

I can't quite see what's wrong with that...

[ Parent | on HN ]

Re:Devs unknowingly use “malicious” modules snuck into offic... by tokenizerrr on Monday September 18, 2017 @10:58AM (#15276485)

Do you have a cellphone? If so, throw it into the trash right now.

[ Parent | on HN ]

Re:Devs unknowingly use “malicious” modules snuck into offic... by swiley on Tuesday September 19, 2017 @10:41AM (#15285045)

I would if I had a girlfriend and she was ok with it. I feel like it's hard to date without one which really sucks.

[ Parent | on HN ]

Re:Devs unknowingly use “malicious” modules snuck into offic... by Waterluvian on Sunday September 17, 2017 @10:43PM (#15273001)

I love Python for this. Big standard library. I hate JavaScript for this... So many weird legacy issues that generally get resolved with libraries. Though ES6 went a long long way.

[ Parent | on HN ]

Re:Devs unknowingly use “malicious” modules snuck into offic... by seanp2k2 on Monday September 18, 2017 @03:51AM (#15274069)

ES6 does not fix the left-pad issue; there is a propensity to use a package to get one small function vs using a library of common helper functions (which is somewhat what e.g. ES6 helps with...less need for underscore or similar). You pretty much don't need jquery now, but so many things depend on it for convenience / backward compatibility / because it's so insanely battle-tested that you know that it will work or at least have a StackOverflow explaining why a particular thing does a thing in a weird way.

[ Parent | on HN ]

Re:Devs unknowingly use “malicious” modules snuck into offic... by Ajedi32 on Monday September 18, 2017 @09:40AM (#15275796)

> ES6 does not fix the left-pad issue

Actually, for that particular problem... https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...

[ Parent | on HN ]

Re:Devs unknowingly use “malicious” modules snuck into offic... by Can_Not on Monday September 18, 2017 @02:59PM (#15278529)

> there is a propensity to use a package to get one small function vs using a library of common helper functions

Lodash functions are available in both forms.

[ Parent | on HN ]

Re:Devs unknowingly use “malicious” modules snuck into offic... by GrumpyNl on Monday September 18, 2017 @06:57AM (#15274779)

The node.js community sees that very different and thats one aspect i dont understand, the blinded trust in dependencies. A midsize project will need quickly a 1000+ dependencies and we have to trust them all.

[ Parent | on HN ]

Re:Devs unknowingly use “malicious” modules snuck into offic... by alanh on Sunday September 17, 2017 @10:42PM (#15272996)

you're not wrong. once i wrote a whole blog post about how to properly include Boost into C++ code using a particular IDE.

[ Parent | on HN ]

Re:Devs unknowingly use “malicious” modules snuck into offic... by seanp2k2 on Monday September 18, 2017 @03:54AM (#15274081)

I put Boost up there with PyQt in terms of my annoyance with it and how hard is had been to get it working correctly for the things which have required it. The XQuartz stuff with macOS is also pretty annoying. Bash an OpenSSL versions would be another.

[ Parent | on HN ]

Re:Devs unknowingly use “malicious” modules snuck into offic... by LaneRendell on Sunday September 17, 2017 @10:03PM (#15272861)

Haha, I was just about to come say that.

[ Parent | on HN ]