News for hackers. Stuff that matters.

A comment on LiteLLM Python package compromised by supply-chain attack. Parent comment

Re:LiteLLM Python package compromised by supply-chain attack by pabs3 on Tuesday March 24, 2026 @11:30PM (#47512911)
> Are you really checking all the files in there, even the binaries?

One should never trust the binaries, always build them from source, all the way down to the bootloader.

https://bootstrappable.org/

Checking all the files is really the only way to deal with potential malware, or even security vulns.

https://github.com/crev-dev/

[ Parent | on HN ]
Re:LiteLLM Python package compromised by supply-chain attack by dist-epoch on Wednesday March 25, 2026 @07:07AM (#47515774)
Nice ideal, but Chrome/Firefox would take days to build on your average laptop (if it doesn't run out of memory first).
[ Parent | on HN ]
Re:LiteLLM Python package compromised by supply-chain attack by pabs3 on Wednesday March 25, 2026 @10:34AM (#47517892)
The latest Firefox build that Debian did only took just over one hour on amd64/armhf and 1.5 hours on ppc64el, the slowest Debian architecture is riscv64 and the last successful build there took only 17.5h, so definitely not days. Your average modern developer-class laptop is going to take a lot less than riscv64 too.
[ Parent | on HN ]