3 ms·
I deal with aggressive vulnerability management at work, and we have a unified pipeline. Figuring out what our servers will be running versus what we are doing
by piyh 3y ago
I deal with aggressive vulnerability management at work, and we have a unified pipeline. Figuring out what our servers will be running versus what we are doing locally versus what the pipeline expects us to do for dependencies, plus vuln management is so much work.
God forbid you have to upgrade a base python version and reopen the dusty tomes of python dependency hell.
- _8j50 3y agoI work in infosec as well and I have yet to even look into malicious pip packages (although I've seen malicious nuget packages), with the last curl vuln it was chaotic, telling people a lot of things actually use libcurl. Can you imagine if something like the requests or urllib package became compromised, absolutley no real way to manage the patching, projects using old versions of it will be forced to upgrade and every package that claims it needs a specific version will break, pure chaos!
- fmajid 3y ago> reopen the dusty tomes of python dependency hell. They are bathed regularly in the blood of a thousand virgins and anything but dusty