News for hackers. Stuff that matters.

A comment on LiteLLM Python package compromised by supply-chain attack. Parent comment

Re:LiteLLM Python package compromised by supply-chain attack by MetaWhirledPeas on Tuesday March 24, 2026 @02:58PM (#47507496)
> real-world identity

This bit sounds like dystopian governance, antithetical to most open source philosophies.

[ Parent | on HN ]
Re:LiteLLM Python package compromised by supply-chain attack by 2OEH8eoCRo0 on Tuesday March 24, 2026 @03:03PM (#47507549)
Would you drive on bridges or ride in elevators "inspected" by anons? Why are our standards for digital infrastructure and software "engineering" so low?

I don't blame the anons but the people blindly pulling in anon dependencies. The anons don't owe us anything.

[ Parent | on HN ]
Re:LiteLLM Python package compromised by supply-chain attack by MetaWhirledPeas on Tuesday March 24, 2026 @03:11PM (#47507626)
This option is available already in the form of closed-source proprietary software.

If someone wants a package manager where all projects mandate verifiable ID that's fine, but I don't see that getting many contributors. And I also don't see that stopping people using fraudulent IDs.

[ Parent | on HN ]
Re:LiteLLM Python package compromised by supply-chain attack by mastermage on Tuesday March 24, 2026 @06:04PM (#47510122)
Do you know who inspected a bridge before you drive over it?
[ Parent | on HN ]
Re:LiteLLM Python package compromised by supply-chain attack by pamcake on Wednesday March 25, 2026 @01:42AM (#47513731)
A business or government can (should) separately package, review, and audit code without involving upstream developers or maintainers at all.
[ Parent | on HN ]