Python typosquatting is about more than typos

Re:Python typosquatting is about more than typos by 3pt14159 on Friday October 02, 2020 @03:12PM (#24666023)

What we really need is a web-of-trust. I've been saying this for years. I know who I trust on GitHub. We even have our public keys there. It's perfectly possible to sign a release with an SSH key, even if GPG would be better.

It won't solve all the issues[0], but it would solve many of these obvious, unskilled attacks and I'm getting kinda sick of the blasé attitude in OSS.

[0] For example, an honest software developer can get local malware that could modify a file just before it is committed and signed.

[ Parent | on HN ]

Re:Python typosquatting is about more than typos by pjc50 on Friday October 02, 2020 @03:46PM (#24666379)

cough Debian has enforced this for at least two decades.

[ Parent | on HN ]

Re:Python typosquatting is about more than typos by 3pt14159 on Friday October 02, 2020 @05:00PM (#24666974)

Yes! And there are some steps in the Ruby community to pull in a web-of-trust as well. It's just frustrating that it didn't happen from the get-go in language after language.

That said, I applaud the Debian folks for putting in the work early. Not just in the web-of-trust, but in many aspects of software security.

[ Parent | on HN ]

Re:Python typosquatting is about more than typos by swsieber on Friday October 02, 2020 @10:22PM (#24668979)

You mean like crev? https://github.com/crev-dev/crev/

Basically a web of code reviews. There is a pup integration in the early stages per the README. I came across crev through the cargo/rust integration.

[ Parent | on HN ]