3 ms·

"Success of the attack relies on negligence of the developer" How about package manager managers accept their enourmous responsabilty? urllib vs urllib2, one i

• singularity2001 9y ago
  The least they can do is create an alias system for common libs or disallow some lib names. Another easy thing to implement would be a popularity check: "This package was only installed nnn times. Did you mean xxx, or do you want to proceed with the installation of yyy by author dev@g00gle.com?" Email verification is a must.
• bughunter3 9y ago
  There are over 100,000 packages and PyPI is run by volunteers. This is not practical. PyPI is not a curated distribution.
  • singularity2001 9y ago
    there are many ways to reduce the likelihood of malicious packages. not all of them require active curation. some can be systemic.
• zokier 9y ago
  Managing supply chain is one the basic principles of good engineering. Not properly vetting your sources is negligence. The problem of course is that computers are really good at amplifying work, including mistakes. So small mistake, like a typo, could have catastrophic impact, like injecting malware that can take over the whole system.
  • deleted 9y ago
    [deleted]