I also use dependency checkers that monitor al those various packages for CVEs related to particular versions. I think I typically catch them during dev and GitHub does a pretty good job of detecting and even suggesting updates.
There is a risk that a package gets corrupted at a used version, but I think that’s fairly small and would be detected quickly. But I think that’s similar to what would happen if Microsoft or Apple put out a bad update. And pypi is policed better than commercial setups that don’t have checks and balances (eg, SolarWinds)
yes but people do and all the training in the worldn't isn't going to help - the package manager needs safe defaults that prevent this sort of thing.
There are some package managers like R’e CRAN that are really thorough on what gets in, so maybe if pypi got more volunteers they could start a “tested” tier where updated require test suites and whatnot.
Pypi is not a white list, it’s just an index.
People shouldn’t randomly download packages without understanding and verifying EVERY one.
I think this is lazy devs and users who mixed up the App Store with pypi. These “exploits” aren’t very useful other than helping people understand these problems.
It seems like an easy solution that some company could set up to test and verify packages and create a white list service that I could subscribe to.
I currently use dependency checkers like safety and snyk that will alert me to real vulnerabilities like when someone takes over a package.
That I care about. We’re someone to take over pandas and put malicious code, that would be damaging.
That’s also why I pin all packages to specific versions and don’t update unless necessary.
I think this can be solved by better training.
I worry that these articles are some new form of FUD against Python. So far, I’ve gotten some non-tech security folks ping me about “Python vulnerabilities” because they read these articles. But it’s pretty easy to evaluate if my org is actually at risk by reviewing the dependency graph and seeing that no one is using these 3500 bogus packages.