News for hackers. Stuff that matters.

A comment on Malicious PyPI packages stealing credit cards and injecting code. Parent comment

Re:Malicious PyPI packages stealing credit cards and injecti... by parhamn on Tuesday August 03, 2021 @12:05PM (#28050871)
I was wondering earlier how useful deno's all-or-nothing policies would actually be in the real world. It seems like rules like this (no dep network requests, intranet only, only these ips) are much more useful than "never talk to the web".

For python this probably wont ever be possible given the way the import system works and the patching packages can do.

[ Parent | on HN ]
Re:Malicious PyPI packages stealing credit cards and injecti... by tadfisher on Tuesday August 03, 2021 @12:45PM (#28051321)
Portmod[0] is a package manager for game modifications (currently Morrowind and Doom), and it runs sandboxed Python scripts to install individual packages. So I think this is possible, but it's not a built-in feature of the runtime as is the case for deno.

[0]: https://gitlab.com/portmod/portmod

[ Parent | on HN ]