5 ms·
You can't do much beyond setting up a corporate proxy that blocks or inspects outbound connections. Even then, you're relying on luck. These days it's practica
by richbell 3y ago
You can't do much beyond setting up a corporate proxy that blocks or inspects outbound connections. Even then, you're relying on luck.
These days it's practically a necessity for companies to shell out money to some sort of supply-chain protection software (Sonatype, Socket.dev etc.)
- lanstin 3y agoMake the corporate proxy use an allow list only. Even then you fall prey to official PyPi hacked packages, but at least then the cryptominers or discord cred stealers can’t phone home.
- kjok 3y ago> These days it's practically a necessity for companies to shell out money to some sort of supply-chain protection software (Sonatype, Socket.dev etc.) A number of some serious assumptions here. How can you be sure that you’re protected if you spend money on these commercial tools? It’s an arms race after all. There are other ways to protect yourself (pinning dependencies, allow list). A few open source tools are also available to audit code.