Talk Python To Me - Python Conversations For Passionate Developers

One of the true superpowers of Python is the libraries over at the Python Package Index. They are all just a "pip install" away. Yet, like all code that you run on your system, it is done with some degree of trust. How do we know that all of those useful packages are trustworthy? That's the topic of this episode. Bentz Tozer and John Speed Meyers are here to share their research into typosquatting on PyPI and other sneaky deeds. But we also discuss some potential solutions and fixes. Links from the show Overview topics SolarWinds: csoonline.com XCodeGhost: macrumors.com Python Package Index nukes 3,653 malicious libraries uploaded: theregister.com Dependency confusion: medium.com Typosquatting Is About More Than Typos: iqt.org Approaches to Protecting the Software Supply Chain: iqt.org A Quant’s View of Software Supply Chain Securityz: usenix.org Organizations Open Source Security Foundation (OpenSSF): openssf.org Python Security Response Team: python.org Proposed solutions and tools pypi-scan: github