4 ms·
This is only true if you aren’t internally mirroring those packages. Most places I’ve worked have Artifactory or something like it sitting between you and actu
by everforward 6mo ago
This is only true if you aren’t internally mirroring those packages.
Most places I’ve worked have Artifactory or something like it sitting between you and actual PyPI/npm/etc. As long as someone has pulled that version at some point before the internet goes out, it’ll continue to work after.
- kjok 6mo agoAnd this is exactly why we see noise on HN/Reddit when a supply-chain cyberattack breaks out, but no breach is ever reported. Enterprises are protected by internal mirroring.