3 ms·

I'm not super happy about log4j as it affected us through a third party install (via PyPI even!). But the issue I see is that larger software installations hav

by bb88 4y ago

I'm not super happy about log4j as it affected us through a third party install (via PyPI even!). But the issue I see is that larger software installations have larger attack surfaces. And the typical python, js, golang (eg.) projects are just exploding in dependencies. I think the python project I run at work is now over 100 deps on PyPI. My simplistic golang side project is around 50 or so.

kjeetgill 4y ago
What PyPI dependency exposed you to log4j? That's too intriguing to pass on.
- bb88 4y ago
  Appdynamics. https://pypi.org/project/appdynamics/ https://pypi.org/project/appdynamics/ It's a front end for gathering metrics about webservers and the like. And sure enough sitting in site-packages were these java jar files.