4 ms·
> Second option: signed packages. A warning when a package is not digitally signed. It's trivial to sign a malicious package with a signature. The problem is
by X6S1x6Okd1st 6y ago
> Second option: signed packages. A warning when a package is not digitally signed.
It's trivial to sign a malicious package with a signature.
The problem is to check and make sure it's signed with the signature
- Spivak 6y agoAnd it doesn't help typosquatting since baeutifulsoup will have a perfectly valid signature.