3 ms·

Whoa urlib & urllib3. Those are pretty popular packages, especially to newbies. Hundreds of websites that teach web-scraping use those libraries. Wonder what i

• zapt02 9y ago
  > Do digitally signed certificates fit into this usage scenario?? No, because either the package author would have to sign them, in which case you have to choose to trust each package author, or the repository would sign them, in which case there would be no improvement for this current issue, since the repo would sign the fake packages as well.
  • kumarvvr 9y ago
    Any way in which blockchain technology can be used? Like, the transaction becomes the act of the author uploading the code and the repo and user verify the transaction in some form?
    • peterwwillis 9y ago
      Nope. You can't solve phishing with technological means. You have to curate either a whitelist or blacklist. The best way to handle this is whitelists of trusted package maintainers and/or code authors.
      • kumarvvr 9y ago
        Ohh ok. Thanks. Great to know.
      • zapt02 9y ago
        To be fair you can do a lot with simple heurestics. New package + large number of downloads || new package || new package author = show users a warning message before installing the package.
  • thehardsphere 9y ago
    If you can't trust the package author at all then you shouldn't use their package.