Myths developers believe about open source security
summary
Claim: a single dependency constraint can produce 10^81 possible graphs so your install is only the graph on this machine at this time. Evidence: ecosystem scans show many PURLs map to different packages, dependency graphs shift faster than a git commit, and Git tags can be reassigned to hide changes. Tool/fix notes: pip no-integrity-by-default (use require-hashes), lockfile-based managers and uv do integrity. Ops: PyPI removes most malicious packages in ~24–36h, npm an order of magnitude slower; some JS malware gets hundreds of thousands of downloads before takedown and attackers in one case net about $5.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:03Myth: Python packages are easy and safe
- 5:19Myth: Only one dependency graph
- 8:26Myth: Names are unique
- 10:12Myth: Popular packages are secure
- 16:39Myth: Open source is immutable
- 20:12Myth: Python 2 is still used
- 23:01Myth: AI won't save security
- 27:09Q&A
related talks
42mHacking the OSS Supply Chain
40mDependency Management: The Cause of—and Solution to—All Supply...
38mDependency Management: The Cause of—and Solution to—All Supply...
30mDependency management: the cause of—and solution to—all supply chain problems
37mThe State of Open Source Security
45mNext Gen Package Management
51mOSS Supply Chain Threats and Why You Need a Holistic Security Strategy
26mSecure Software Supply Chains for Python