6 ms·
As explained in another thread, nothing went wrong with the tooling and namespacing. The PyTorch devs misused a feature intended for a different use-case. I to
by dwightgunning 4y ago
As explained in another thread, nothing went wrong with the tooling and namespacing. The PyTorch devs misused a feature intended for a different use-case.
I took a look and the vulnerability that was exploited is warned about and described in the documentation.
> Warning
> Using this option to search for packages which are not in the main repository (such as private packages) is unsafe, per a security vulnerability called dependency confusion: an attacker can claim the package on the public repository in a way that will ensure it gets chosen over the private package.
https://pip.pypa.io/en/stable/cli/pip_install/#examples https://pip.pypa.io/en/stable/cli/pip_install/#examples
- jacquesm 4y agoAnd that's even further removed from the claim that this could be fixed at the operating system level: an operating system is powerless against people that bypass security measures willfully. But regardless, this option, even if available should always result in a warning when there is a change of effective source for a chunk of code that was previously included blindly from another source.