3 ms·
Well presumably under that threat model you'd run your own package cache. But in practice that doesn't really seem to be a thing that happens. Python hasn't had
by Doxin 6y ago
Well presumably under that threat model you'd run your own package cache. But in practice that doesn't really seem to be a thing that happens. Python hasn't had the equivalent of left-pad yet as far as I know.
- Isinlor 6y agoYou may want to take a look: https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610 https://medium.com/@alex.birsan/dependency-confusion-4a5d60f... Security by "it hasn't happen yet" is not a security.