I could only find this PyCon 2012 talk (https://pyvideo.org/pycon-us-2012/advanced-security-topics.html https://pyvideo.org/pycon-us-2012/advanced-security-topi

I could only find this PyCon 2012 talk (https://pyvideo.org/pycon-us-2012/advanced-security-topics.html https://pyvideo.org/pycon-us-2012/advanced-security-topics.h...), but there was a session in 2010 that was perhaps more zeroed in on this topic. It was evident then that these problems affected every packaging and dependency ecosystem, but it was hard to get devs to take it seriously. The pattern plays out with every new wave in our industry. You can even see this with the k8s ecosystem where there is a ton of complexity and opportunity for attackers. It's only later that security is taken more seriously when it could be designed in from the start. We love to mitigate things that we could eliminate in original designs.