News for hackers. Stuff that matters.
Re:Software downloaded 30k times from PyPI ransacked develop... by pfbtgom on Friday July 30, 2021 @11:17AM (#28008927)
With the release of GitHub’s Copilot, I wonder how far we are from ML identification of malicious repositories.
[ Parent | on HN ]
Re:Software downloaded 30k times from PyPI ransacked develop... by remram on Friday July 30, 2021 @07:50PM (#28013843)
Isn't this a halting problem sort of endeavor? Figuring out if any possible input to the library triggers a "bad" outcome?
[ Parent | on HN ]
Re:Software downloaded 30k times from PyPI ransacked develop... by sjg007 on Friday July 30, 2021 @01:32PM (#28010303)
Worthy startup idea!
[ Parent | on HN ]
Re:Software downloaded 30k times from PyPI ransacked develop... by remram on Friday July 30, 2021 @10:49AM (#28008580)
crev is an open-source framework trying to fix this, using a web-of-trust approach to reviews: https://github.com/crev-dev/

Currently only available for Cargo, Rust's package manager, but more integrative are being developed.

[ Parent | on HN ]
Re:Software downloaded 30k times from PyPI ransacked develop... by raxxorrax on Friday July 30, 2021 @08:29AM (#28007228)
While this is a logistical problem and people generally don't check code in the dependency tree, I already fear the security mechanisms that might spawn from this.
[ Parent | on HN ]
Re:Software downloaded 30k times from PyPI ransacked develop... by Engineering-MD on Friday July 30, 2021 @10:21AM (#28008286)
Did you have anything specific in mind?
[ Parent | on HN ]
Re:Software downloaded 30k times from PyPI ransacked develop... by 0des on Friday July 30, 2021 @03:03PM (#28011156)
stdlib or die.

/me flashes obscure gang insignia

[ Parent | on HN ]