News for hackers. Stuff that matters.

A comment on Python Malware Starting to Employ Anti-Debug Techniques. Parent comment

Re:Python Malware Starting to Employ Anti-Debug Techniques by weakfortress on Friday December 23, 2022 @11:39AM (#34107710)
Even simpler solution: Require cryptographic signatures of the developers of projects along with hash-verified downloads via pip.

The problem is a failure to understand security.

[ Parent | on HN ]
Re:Python Malware Starting to Employ Anti-Debug Techniques by Blackthorn on Friday December 23, 2022 @01:39PM (#34109190)
Requiring anything from open source authors is a losing proposition. Items of interest just won't end up on pypi. Iirc this chain of events already happened on another distribution platform.
[ Parent | on HN ]
Re:Python Malware Starting to Employ Anti-Debug Techniques by anakaine on Friday December 23, 2022 @02:49PM (#34109883)
A malicious author could embed malicious code in the package and still get the package signed. Hashing won't prevent this sort of thing on PyPi, it just addresses in transit and alternate supplier attacks.
[ Parent | on HN ]