3 ms·
Two interesting takeaways from the paper itself[1]: Chinese companies and universities appear to make extensive use of PyPI mirrors (references 23-26), and thos
by woodruffw 3y ago
Two interesting takeaways from the paper itself[1]: Chinese companies and universities appear to make extensive use of PyPI mirrors (references 23-26), and those mirrors consistently fail to purge malicious packages in a timely manner.
[1]: https://about.honywen.com/publication/2023ase/2023ASE.pdf https://about.honywen.com/publication/2023ase/2023ASE.pdf
- ashishbijlani 3y agoInteresting. I wonder if this is also true for available/existing commercial/open-source PyPI mirroring solutions [Edited].
- blueflow 3y agoWhy would the Chinese have their own pypi mirror software? I think they are running the same software as western companies.
- pxeger1 3y agoProbably because accessing PyPI directly is slow, because of the Great Firewall.
- woodruffw 3y agoI think the GP is asking why Chinese engineers would have their own software for mirroring, not why they'd have their own mirrors. (I believe most Chinese mirrors use bandersnatch[1], like most non-Chinese mirrors.) [1]: https://github.com/pypa/bandersnatch https://github.com/pypa/bandersnatch