4 ms·
Account Takeover and Malicious Replacement of Ctx Project
- samwillis 4y agoI think it’s increasing obvious that uncurated package managers (PyPI, NPM, etc.), while so brilliant for discoverability and development speed, expose a very large security risk. It seems to me there are two options: - curated package manager, potentially paid, that ensure the security of the libraries available. - languages/platforms that are able to sandbox, with permissions, at the library level. I’m not sure what the way forward is but I don’t think the status quo can necessarily continue.
- brokenmachine 4y agoMaybe some kind of permissions system a bit like Android app permissions? Of course that wouldn't help with libraries that actually do need network access though.