3 ms·
Even simpler solution: Require cryptographic signatures of the developers of projects along with hash-verified downloads via pip. The problem is a failure to u
by weakfortress 4y ago
Even simpler solution: Require cryptographic signatures of the developers of projects along with hash-verified downloads via pip.
The problem is a failure to understand security.
- Blackthorn 4y agoRequiring anything from open source authors is a losing proposition. Items of interest just won't end up on pypi. Iirc this chain of events already happened on another distribution platform.
- anakaine 4y agoA malicious author could embed malicious code in the package and still get the package signed. Hashing won't prevent this sort of thing on PyPi, it just addresses in transit and alternate supplier attacks.