Two malicious Python libraries caught stealing SSH and GPG keys

Re:Two malicious Python libraries caught stealing SSH and GP... by johnday on Wednesday December 04, 2019 @09:27AM (#21702389)

Placing the burden of responsibility for security on the end user is not the way to go about this - at least, not if you want people to actually use your product / language.

Package managers do not only exist as a convenience. They should also provide guarantees about their packages, or at the very least some level of moderation.

[ Parent | on HN ]

Re:Two malicious Python libraries caught stealing SSH and GP... by swiley on Saturday December 07, 2019 @06:17PM (#21733286)

You could make that argument about repositories not package managers (which are just software.)

Some do! (Main OS repos (not community ones) do.) But the reality is that this takes man hours, so repositories have been set up without those guarantees in the name of efficiency and expectation of responsibility.

I don’t think these are built because people “want users for their language” but because they were needed. This whole “you shouldn’t do that because it scares users away” thing tends to result in terrible software IMO.

[ Parent | on HN ]