brucethemoose comments on public services of an entire german state switches from Microsoft to open source (Libreoffice, Linux, Nextcloud, Thunderbird)

[–] brucethemoose@lemmy.world 3 points 1 year ago* (4 children)

There already are. I barely missed a linux virus from a hijacked python package what... two years ago?

Linux desktops are quite non-homogenous though, so their vectors/nature is kinda different.

permalink

fedilink

source

parent

hideshow 4 child comments

[–] sugar_in_your_tea@sh.itjust.works 1 point 1 year ago (3 children)

Sure, and they have been for decades. They're still not that common though.

What Python package almost got you?

I wonder if I've been hit but just haven't noticed because I tend to run things in containers.

permalink

fedilink

source

parent

hideshow 3 child comments

[–] brucethemoose@lemmy.world 3 points 1 year ago* (1 child)

Pytorch Nightly: https://pytorch.org/blog/compromised-nightly-dependency/

https://www.theregister.com/2023/01/04/pypi_pytorch_dependency_attack/

Funnily enough I can't even post what it does without the Lemmy comment filter zapping me, but it tried to scrape accounts and passwords.

The malicious binary would upload files ranging in size up to 99,999 bytes and send the contents to a specified domain.

Was pretty scary from my perspective. I missed it by a week. PyPi is a mess, and it makes me wonder how much isn't caught.

permalink

fedilink

source

parent

hideshow 1 child comment

[–] sugar_in_your_tea@sh.itjust.works 2 points 1 year ago

That is scary. But it does require using a custom repository, so hopefully few were hit.

We use poetry, enough which allows specifying additional package repos and it looks like we'd be susceptible to the same attack, but for our internal package index. Looks like I have something to fix this week, thanks for the link!

permalink

fedilink

source

parent

[+] brucethemoose@lemmy.world 1 point 1 year ago

[deleted]

permalink

fedilink

source

parent