Re:Python Malware Starting to Employ Anti-Debug Techniques
by nine_k on Friday December 23, 2022 @06:34AM
(#34104689)
Such an authority in the Linux world used to be a distribution. Installing a binary blob provided by Debian build servers is based on decades of trust.
But there is a tradeoff between having things thoroughly vetted and tested, and moving fast.
Re:Python Malware Starting to Employ Anti-Debug Techniques
by nonrandomstring on Friday December 23, 2022 @08:32AM
(#34105567)
Interesting point. So as dimensions we now have
- security
- freedom
- convenience
- speed/newness
Re:Python Malware Starting to Employ Anti-Debug Techniques
by dylan604 on Friday December 23, 2022 @12:06PM
(#34108122)
You're an HN reader, so you should be able to knock this out over a weekend /s
Re:Python Malware Starting to Employ Anti-Debug Techniques
by nonrandomstring on Friday December 23, 2022 @01:20PM
(#34108966)
You're right the prototype GUI is a weekend of work. But you also know
that's not where the work is :) Now some more intelligent comments are
coming in we can talk about the analysis and tagging of thousands of
packages, dealing with backward compatibility and what happens when
naughty malware just hops to another level of trust.
But none of that is a call to give up. We just need to think seriously about the problem we face.
It's a convenience/security trade-off, I see.
The only solution I've ever seen to that requires investing trust in an "authority" which then becomes corrupt and censorial. One simply expands the dilemma to a triad; security/freedom/convenience.
If I am not mistaken the PyPI "Cheese Shop" is owned by the Python Software Foundation, a 501(c3) nonprofit organisation which constitutionally values Software Freedom highly. It seems natural that convenience would be sacrificed if security is of concern.