Hacker News Reader

I think this has more to due with the contexts/industries we typically see Python used in over pure popularity. If popularity was the only factor I'd expect to seeing a lot more news about these problems in Java/PHP ecosystems which are absolutely massive.

View on HN

Java is special since it has mandatory version pinning of all dependencies, doesn't run code at install time and uses a full url for dependency names. That means dependencies don't auto-update, don't compromise CI/CD as easily and don't get misspelled as easily (ie: people copy paste the whole name+version versus writing it from memory).

Many languages since then decided that causes too much overhead.

I mean, PHP is pretty much a domain specific language, and we're only about a year out from log4j.

Log4 wasn't malicious.

;)

Reply on news.ycombinator.com