News for hackers. Stuff that matters.

A comment on 3500 packages uploaded to PyPI, pointing to a malicious URL. Parent comment

Re:3500 packages uploaded to PyPI, pointing to a malicious URL by lordlimecat on Tuesday March 02, 2021 @02:32PM (#26319395)
A good black box relies on the assumption that the inputs / outputs are well documented and true to their spec.

This is a very unsafe assumption, at least until we invent a programming language that disallows bugs of any class.

[ Parent | on HN ]
Re:3500 packages uploaded to PyPI, pointing to a malicious URL by alisonkisk on Tuesday March 02, 2021 @03:29PM (#26320182)
What's the point of a philosophy that is impossible to live up to. Nobody audits a substantial fraction of their dependencies.
[ Parent | on HN ]
Re:3500 packages uploaded to PyPI, pointing to a malicious URL by a1369209993 on Tuesday March 02, 2021 @05:49PM (#26322224)
> Nobody audits a substantial fraction of their dependencies.

I do! In fact if we exclude the language implementation itself[0], a plurality of my projects have NaN% of their dependencies fully audited.

0: ie, compiler, hardware, etc; if you object to this, please do explain how to eliminate these dependencies; I'm quite interested.

[ Parent | on HN ]
Re:3500 packages uploaded to PyPI, pointing to a malicious URL by bpt3 on Tuesday March 02, 2021 @04:13PM (#26320841)
> What's the point of a philosophy that is impossible to live up to. Nobody audits a substantial fraction of their dependencies.

It's a choice to be ignorant of your dependencies, not a law of nature.

The fact that most people don't audit code they depend upon is a problem to be fixed, unless the underlying code is fixed first.

[ Parent | on HN ]