News for hackers. Stuff that matters.

A comment on Python 3.12.0 from a supply chain security perspective.

Re:Python 3.12.0 from a supply chain security perspective by amelius on Thursday October 05, 2023 @10:45AM (#37779252)
Didn't Anaconda show that the whole Pip approach is flawed and we need a language-agnostic/multi-language approach?
[ Parent | on HN ]
Re:Python 3.12.0 from a supply chain security perspective by maxloh on Thursday October 05, 2023 @11:08AM (#37779582)
npm works great on JavaScript.
[ Parent | on HN ]
Re:Python 3.12.0 from a supply chain security perspective by underclocked on Thursday October 05, 2023 @11:12AM (#37779635)
Are you being serious?

https://www.cpomagazine.com/cyber-security/open-source-devel...

https://therecord.media/malware-found-in-npm-package-with-mi...

...

and the list goes on

[ Parent | on HN ]
Re:Python 3.12.0 from a supply chain security perspective by xkcd-sucks on Thursday October 05, 2023 @12:34PM (#37780731)
You can even use npm to manage and publish Python code, or could a few years ago if they haven't added constraints on the registry since then
[ Parent | on HN ]