very interesting
i wonder about the over-dependence on third party packages and modules
imagine the author of 'is-odd' injects a trojan there
what are you gonna do?
C has this solved but 'vendoring' is not as fast as this approach
i wonder about the over-dependence on third party packages and modules
imagine the author of 'is-odd' injects a trojan there
what are you gonna do?
C has this solved but 'vendoring' is not as fast as this approach
Compiled binaries are harder, you might consider compiling them from source and comparing the output. This is where build reproducibility comes in to play.
There's a lot more coming in the Python packaging security space that'll make this easier and just safer in general. Stay tuned :)
Of course 90% of the downloads come from the pinned old versions.
They were so inefficient… and are still contributing to create waste even though the new releases are like 20x faster.
The issue is, for any given implementation, similar attacks could still happen, and the package repos are still probably vulnerable.
It hasn't… but C developers are much more careful about adding a dependency than js/python/rust/go developers. Mostly because adding a dependency in C is more annoying. In those languages it's just about adding one line.
Of course if you use a distribution and it's a famous library, it's to add a line as well. But then there is the filter of the distribution. Which would work for any language, but most developers vendor everything instead.
"Reflections on Trusting Trust" was a demonstration of this in the C ecosystem long before package managers were a thing.
These days it's practically a necessity for companies to shell out money to some sort of supply-chain protection software (Sonatype, Socket.dev etc.)
A number of some serious assumptions here. How can you be sure that you’re protected if you spend money on these commercial tools? It’s an arms race after all. There are other ways to protect yourself (pinning dependencies, allow list). A few open source tools are also available to audit code.