Update from our Security Engineers
summary
Progress report lists concrete outcomes: an in‑progress software bill of materials for Python packages to make scanners and compliance tools accurate; pip now uses system certificates by default; the security team publishes 16 advisories this year and automates alerting; a new project quarantine feature plus auto‑quarantine cuts malicious packages’ live time; full enforcement of two factor authentication on PyPI since Jan 1; mitigations for domain‑resurrection attacks and noisy but useful typo‑squatting detection; planning for the Cyber Resilience Act.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 0:46T-shaped security roles
- 1:33Software Bill of Materials for Python packages
- 2:16PIP certificate verification
- 3:01Security automation and CRA
- 4:04Security in a box
- 4:46Malware on PyPI
- 6:312FA enforcement on PyPI
- 7:33Domain resurrection attacks
- 8:36Typo squatting detection
- 9:19Security updates
related talks
29mMaking Python safer than ever
16mUpdate from our Security Engineers
25m"Security considerations in Python Packaging"
19mThe Power of Dedicated Security Engineers vs. Volunteers
26mSecure Software Supply Chains for Python
20mMalicious Needle in a Haystack - PyPi Security Pitfalls
10mPyPI Supply Chain Security
16mMeet our Security Engineers