News for hackers. Stuff that matters.

A comment on Compromised PyTorch-nightly dependency chain December 30th, 2022. Parent comment

Re:Compromised PyTorch-nightly dependency chain December 30t... by dehrmann on Saturday December 31, 2022 @11:51PM (#34203709)
Publishing to Maven Central is a bit of a pain, but the manual effort, doc jars, signed jars, etc. help with security and keep away low-effort packages.
[ Parent | on HN ]
Re:Compromised PyTorch-nightly dependency chain December 30t... by dandiep on Sunday January 01, 2023 @12:46AM (#34203969)
Also, a pretty sophisticated way to manage transitive dependencies. Python is an absolute mess in this regard (as well as pretty much everything else with dependency management…)
[ Parent | on HN ]