Hacker News Reader

Two interesting takeaways from the paper itself[1]: Chinese companies and universities appear to make extensive use of PyPI mirrors (references 23-26), and those mirrors consistently fail to purge malicious packages in a timely manner.

[1]: https://about.honywen.com/publication/2023ase/2023ASE.pdf

View on HN

Interesting. I wonder if this is also true for available/existing commercial/open-source PyPI mirroring solutions [Edited].

Why would the Chinese have their own pypi mirror software? I think they are running the same software as western companies.

Probably because accessing PyPI directly is slow, because of the Great Firewall.

I think the GP is asking why Chinese engineers would have their own software for mirroring, not why they'd have their own mirrors.

(I believe most Chinese mirrors use bandersnatch[1], like most non-Chinese mirrors.)

[1]: https://github.com/pypa/bandersnatch

Reply on news.ycombinator.com