News for hackers. Stuff that matters.

A comment on Devs unknowingly use “malicious” modules snuck into official Python repository. Parent comment

Re:Devs unknowingly use “malicious” modules snuck into offic... by rlpb on Monday September 18, 2017 @03:38AM (#15274022)
Distributions - let's take Debian as a concrete example - provide an audit trail to individual identified developers as a mitigation for users relying on trust. Just because we must necessarily rely on some level of trust does not mean that we must blindly trust, which is what happens when anyone can upload to a repository such as PyPI.
[ Parent | on HN ]
Re:Devs unknowingly use “malicious” modules snuck into offic... by yeukhon on Monday September 18, 2017 @10:39AM (#15276323)
As far as I know, once the project name is taken, that ownership belongs to the account first created this package in PyPI.
[ Parent | on HN ]