News for hackers. Stuff that matters.

A comment on Python typosquatting is about more than typos. Parent comment

Re:Python typosquatting is about more than typos by runarberg on Friday October 02, 2020 @04:10PM (#24666569)
Will URL imports actually solve the problem. Couldn’t a malicious actor simply register a similar name: e.g. `pip install code.lauchpad.net/beautifulsoup`?

I would also guess many packages would be hosted on github: `pip install popular-org.github.io/package` which could be typo-squatted by creating a similar sounding github user `pip install poplar-org.github.io/package`.

[ Parent | on HN ]
Re:Python typosquatting is about more than typos by TylerE on Friday October 02, 2020 @04:57PM (#24666957)
Or for that matter what happens if the original author loses control of the domain?
[ Parent | on HN ]
Re:Python typosquatting is about more than typos by earthboundkid on Friday October 02, 2020 @11:32PM (#24669294)
If you lose the domain, the old packages can’t be changed because they have a hash. New, evil packages are a problem, but that can also happen now if someone steals your password or does an email reset of your account.
[ Parent | on HN ]