Re:Compromised PyTorch-nightly dependency chain December 30t...
by henearkr on Sunday January 01, 2023 @04:42AM
(#34205014)
Staging the packages in experimental then testing, sometimes for months, before going to stable, is doing also a lot against this kind of threats.
Which leads me to wonder: do we really always want the very latest version or the packages? Any slightly older version will be immune to dependency-poisoning, thanks of the scrutiny of users over several weeks.
Re:Compromised PyTorch-nightly dependency chain December 30t...
by usrnm on Sunday January 01, 2023 @06:06AM
(#34205396)
> Which leads me to wonder: do we really always want the very latest version or the packages?
Not really, but then someone needs to decide what version to use and when/how this version is updated. For every single dependency. I agree that keeping track of your dependencies and actually managing them may be better engineering but it's a lot of work not many people want to do
There are thousands, if not tens of thousands, of packages available to install via apt or yum. But most of those packages are packaged by a dedicated maintainer - not any rando. The bar isn't much higher, but there _is_ a bar. Python's (well, pip) practice of letting any vermin with no prior vetting publish is root of the problem in my opinion.