keyP

8 ms·

1. 61.▲
   by keyP 7y ago

   I've met Gergely, the author, a couple of times a while back and he's a great guy and I think we work in a similar way. In the majority of my roles I was initially hired as an engineer but then moved to engineering management and
2. 62.▲
   by keyP 7y ago

   I agree, it's no where near bulletproof, but it's about raising barriers as well as updating the tool once workarounds are found. I don't see an easy solution to this issue but in most of the cases (including the ones in this
3. 63.▲
   by keyP 7y ago

   Highly obfuscated code would raise suspicions, especially in similar cases found in NPM packages. E.g. in Python, obfuscators I've come across tend to replace characters with non-Latin unicode chars, which should raise flags when found
4. 64.▲
   by keyP 7y ago

   One thing I've always thought would be a good idea is a tool (either local or part of the pip/other packet manager download process) that greps and prints out all URLs and IP addresses within the code, including common encodings.
5. 65.▲
   by keyP 7y ago

   There's a bit more to it as "dateutil" is actually installed via "pip install python-dateutil", not simply "pip install dateutil". If someone was to see "python3-dateutil", there's every cha
6. 66.▲
   by keyP 7y ago

   Agreed, although I think there's more than just a comparing spelling issue here. "dateutil" via pip is installed using "pip install python-dateutil". I can easily see someone thinking "python3-dateutil" is