News for hackers. Stuff that matters.

A comment on 3500 packages uploaded to PyPI, pointing to a malicious URL.

Re:3500 packages uploaded to PyPI, pointing to a malicious URL by rainworld on Tuesday March 02, 2021 @11:06AM (#26316739)
How about:

Packages are namespaced and "tier 2" by default.

Official packages, packages from trusted vendors, might-as-well-be-in-the-stdlib packages, otherwise vetted packages, are upgraded to "tier 1", might drop the namespace.

Project manifests can specify: stdlib only, "tier 1" packages only. The latter sounds like a sane default.

[ Parent | on HN ]
Re:3500 packages uploaded to PyPI, pointing to a malicious URL by xapata on Tuesday March 02, 2021 @11:38AM (#26317138)
Who decides what's "Tier 1"? How will you fund their work? Currently there are a few vendors providing what you're asking for, including Anaconda (https://www.anaconda.com/) and ActiveState (https://www.activestate.com/).

> Get the most from your use of Perl, Python or Tcl and reduce your compliance, legal, and security risks. We offer custom managed and self-serve distributions, including support and maintenance, on Windows, Linux, AIX and more – even for 32-bit and older releases.

[ Parent | on HN ]
Re:3500 packages uploaded to PyPI, pointing to a malicious URL by hiq on Tuesday March 02, 2021 @11:48AM (#26317252)
Who decides who is a "trusted vendor", and how? You either give up on a lot of packages or end up in the current situation where everyone is trusted.
[ Parent | on HN ]