4 ms·

At work we don't use PyPI any longer. We have our own set of curated packages, the security issues are just too great: https://developers.slashdot.org/story/24

by zamlag 2y ago

At work we don't use PyPI any longer. We have our own set of curated packages, the security issues are just too great: https://developers.slashdot.org/story/24/09/15/0030229/fake-python-coding-tests-installed-malicious-software-packages-from-north-korea https://developers.slashdot.org/story/24/09/15/0030229/fake-... https://jfrog.com/blog/revival-hijack-pypi-hijack-technique-exploited-22k-packages-at-risk/ https://jfrog.com/blog/revival-hijack-pypi-hijack-technique-... https://jfrog.com/blog/leaked-pypi-secret-token-revealed-in-binary-preventing-suppy-chain-attack/ https://jfrog.com/blog/leaked-pypi-secret-token-revealed-in-... We consider switching to Java, C++ or Rust because of general quality issues with Python.

notpushkin 2y ago
What do Java and Rust (and your C++ package manager of choice) do to mitigate those things?
- ajrqh 2y ago
  What is not clear about "general quality issues", i.e., issues unrelated to package management?
  - notpushkin 2y ago
    OK, my bad. It is even more unclear though – do you have any particular examples of such issues?
- deleted 2y ago
  [deleted]
- theamk 2y ago
  Don't know about Java or Rust, but in C++ it's much harder to get new packages, which works wonder to keep number of dependencies down. In Python, installing packages is so simple, people just do it after 10 second google search - and that library can pull dozens or hundreds of dependencies with usually no review. In C++, given that you have to manually find the library and incorporate into the build system, people generally spend a few minutes looking at the options and choosing the best one - and this includes checking for things "how long has this library been around", "does it have many users" and "is it in healthy state". And this must be repeated for each dependency as well, so that even a dozen of dependencies is a huge negative - and such library will not be used unless there are no better alternatives. (The exception to this rule are libraries provided by your Linux distribution. Those can be easily installed by the dozen, and that's OK - the distribution makers did all the hard work for you, vetting and packaging those libraries) This in general means a much healthier dependency state for C++, as well as much higher code quality. No one is going to add a dependency to a core library just to add a better progress bars for example.

by zamlag 2y ago

notpushkin 2y ago

What do Java and Rust (and your C++ package manager of choice) do to mitigate those things?

ajrqh 2y ago
What is not clear about "general quality issues", i.e., issues unrelated to package management?
- notpushkin 2y ago
  OK, my bad. It is even more unclear though – do you have any particular examples of such issues?
deleted 2y ago
[deleted]
theamk 2y ago
Don't know about Java or Rust, but in C++ it's much harder to get new packages, which works wonder to keep number of dependencies down. In Python, installing packages is so simple, people just do it after 10 second google search - and that library can pull dozens or hundreds of dependencies with usually no review. In C++, given that you have to manually find the library and incorporate into the build system, people generally spend a few minutes looking at the options and choosing the best one - and this includes checking for things "how long has this library been around", "does it have many users" and "is it in healthy state". And this must be repeated for each dependency as well, so that even a dozen of dependencies is a huge negative - and such library will not be used unless there are no better alternatives. (The exception to this rule are libraries provided by your Linux distribution. Those can be easily installed by the dozen, and that's OK - the distribution makers did all the hard work for you, vetting and packaging those libraries) This in general means a much healthier dependency state for C++, as well as much higher code quality. No one is going to add a dependency to a core library just to add a better progress bars for example.