Compromised PyTorch-nightly dependency chain December 30th, 2022

Re:Compromised PyTorch-nightly dependency chain December 30t... by GauntletWizard on Sunday January 01, 2023 @02:10AM (#34204312)

There's a real problem with maven central and java in general that there's no correlation between the package name - which is nicely domain-name formatted - and actual domain names. If there were a clear "this is really thai domain name and DNS verified" and "this is compatible but not DNS verified" marker, it would be great.

I think golang has the best answer for this, where it's easy to impersonate but it has to be explicit.

[ Parent | on HN ]

Re:Compromised PyTorch-nightly dependency chain December 30t... by richbell on Sunday January 01, 2023 @11:16AM (#34207547)

Yeah, it's far from perfect but it does get a lot right. It's painful watching all these new package management tools like pip and npm completely ignore what came before them.

I think Go's approach is interesting, though it does rely on some magic that isn't immediately obvious. I agree that being explicit is a tremendous benefit: it avoids the attack used here, and makes it less likely for typo-squatting to succeed (e.g., `npm install axiod`).

[ Parent | on HN ]