3 ms·
> You're not dealing with projects. You're dealing with keys. It's not one key per project. It's one key per contributor. This has the added bonus that if a con
by zzzeek 9y ago
> You're not dealing with projects. You're dealing with keys. It's not one key per project. It's one key per contributor. This has the added bonus that if a contributor goes rogue, you can revoke the one key and all the suspect projects are are invalidated at once.
you cannot locate said rogue contributor without regularly manually reviewing 117,226 packages.
- danjoc 9y ago>you cannot locate said rogue contributor without regularly manually reviewing 117,226 packages. Herd immunity. Someone is out there reviewing it. Most users won't need to lift a finger beyond verifying signatures.
- donaldstufft 9y ago> Herd immunity. Someone is out there reviewing it. More likely everyone assumes someone else is reviewing it, and nobody actually does.
- danjoc 9y agoWe definitely do where I work. I'm really, really surprised to hear they do not where you work. A multibillion dollar company like Amazon, who runs half the internet with AWS, does not verify dependencies? Wow. That's breathtaking.
- zzzeek 9y agoIf 100k packages are already security audited by the community.. Then what's the issue? They send them to dstufft, he takes them down (which of course does not actually happen because nobody is auditing most packages). As mentioned elsewhere, most contributors to pypi have only one package so the notion of "find one rogue package == dozens of untrustworthy packages removed in one swoop" doesn't really exist (esp because a rogue agent would be making one account / key per package just to avoid this kind of detection!)