News for hackers. Stuff that matters.
Re:3500 packages uploaded to PyPI, pointing to a malicious URL by a1369209993 on Tuesday March 02, 2021 @05:49PM (#26322224)
> Nobody audits a substantial fraction of their dependencies.

I do! In fact if we exclude the language implementation itself[0], a plurality of my projects have NaN% of their dependencies fully audited.

0: ie, compiler, hardware, etc; if you object to this, please do explain how to eliminate these dependencies; I'm quite interested.

There are no comments on this comment yet.