HN user

un_ess

135 karma

Works at Enterprise Solutions Service, Office of Information and Communications Technology

Posts7
Comments16
View on HN

a)"Thanks to backwards compatibility, a package offered only as a source distribution and with the legacy setup.py file for configuration and metadata specification will run the code in setup.py as part of the installation." https://blog.phylum.io/python-package-installation-attacks/

b) pip now has an option _not_ to run arbitrary code by disallowing source distributions, by passing --only-binary :all:

"By default, pip does not perform any checks to protect against remote tampering and involves running arbitrary code from distributions. It is, however, possible to use pip in a manner that changes these behaviours, to provide a more secure installation mechanism." https://pip.pypa.io/en/stable/topics/secure-installs/

Mourning Google 3 years ago

The book "The Idea Factory: Bell Labs and the Great Age of American Innovation" - https://en.wikipedia.org/wiki/The_Idea_Factory describes how the Labs was working. The last chapter tries to figure out why it was working and one of the conclusion is that the Labs was always guided by the long term idea that it might help the telephone company (and that the breakup removed a) the long-term funding b) some kind of direction )

Compare it to VirtualBox, which is clearly not F/OSS,

https://www.virtualbox.org/wiki/Downloads says

"The binaries are released under the terms of the GPL version 3" and the sources are here - https://www.virtualbox.org/browser/vbox/trunk

(up to V6.1, it was licensed under GPL v2 - https://www.virtualbox.org/wiki/GPL )

And VirtualBox is available in Debian: https://wiki.debian.org/VirtualBox notes that "A proprietary extra package enhances the base experience, adding things like RDP access to the Guest. "

United Nations | Software Engineers | Full-time | Onsite | Brindisi (Italy), Valencia (Spain), Bangkok (Thailand), Entebbe (Uganda) or NY (US)

Do you want to work with people who help other people? Do you want to participate in projects to prevent conflicts between nations? Do you want to help countries achieve the Sustainable Development Goals, for a better future of younger generations? Do you want to help us make a better world with your talents?

Join the United Nations Office of Information and Communications Technology (OICT) to develop software solutions using mobile, blockchain, VR/AR, machine learning, data science and other technologies. We use JavaScript, TypeScript, Java, Swift,C#, Python, Linux, Windows, Azure, AWS

To apply https://careers.un.org/lbw/jobdetail.aspx?id=134190&Lang=en-...