News for hackers. Stuff that matters.

A comment on Python Best Practices for a New Project in 2021. Parent comment

Re:Python Best Practices for a New Project in 2021 by ed_balls on Monday July 05, 2021 @08:09AM (#27737107)
How do you make sure your dependencies are not tampered with? https://medium.com/@alex.birsan/dependency-confusion-4a5d60f...
[ Parent | on HN ]
Re:Python Best Practices for a New Project in 2021 by Tipewryter on Monday July 05, 2021 @09:33AM (#27737799)
That is a very broad question. Can you mention a specific attack vector? Then I might be able to explain how I do or do not avoid it.
[ Parent | on HN ]
Re:Python Best Practices for a New Project in 2021 by ed_balls on Tuesday July 06, 2021 @04:55AM (#27745721)
The link describes the attack vector. pipenv locks the dependencies using hash. if you company has my-company-py-lib then pip could install public library that pretends to be internal.
[ Parent | on HN ]