News for hackers. Stuff that matters.
Re:Compromised PyTorch-nightly dependency chain December 30t... by henearkr on Sunday January 01, 2023 @04:42AM (#34205014)
Staging the packages in experimental then testing, sometimes for months, before going to stable, is doing also a lot against this kind of threats.

Which leads me to wonder: do we really always want the very latest version or the packages? Any slightly older version will be immune to dependency-poisoning, thanks of the scrutiny of users over several weeks.

Re:Compromised PyTorch-nightly dependency chain December 30t... by usrnm on Sunday January 01, 2023 @06:06AM (#34205396)
> Which leads me to wonder: do we really always want the very latest version or the packages?

Not really, but then someone needs to decide what version to use and when/how this version is updated. For every single dependency. I agree that keeping track of your dependencies and actually managing them may be better engineering but it's a lot of work not many people want to do