News for hackers. Stuff that matters.

A comment on Python typosquatting is about more than typos. Parent comment

Re:Python typosquatting is about more than typos by X6S1x6Okd1st on Friday October 02, 2020 @04:03PM (#24666513)
> Second option: signed packages. A warning when a package is not digitally signed.

It's trivial to sign a malicious package with a signature.

The problem is to check and make sure it's signed with the signature

[ Parent | on HN ]
Re:Python typosquatting is about more than typos by Spivak on Friday October 02, 2020 @05:30PM (#24667209)
And it doesn't help typosquatting since baeutifulsoup will have a perfectly valid signature.
[ Parent | on HN ]