• 9 Posts
  • 174 Comments
Joined 1 year ago
cake
Cake day: June 13th, 2023

help-circle















  • the overall malware campaign against the Python development community has been running since at least August of 2023, when a number of popular open source Python tools were maliciously duplicated with added malware. Now, though, there are also attacks involving “coding tests” that only exist to get the end user to install hidden malware on their system (cleverly hidden with Base64 encoding) that allows remote execution once present.

    So, a supply chain attack or they’re sending you code to run?

    This is a good time to refer to PEP 668 which enforces virtual environments for non-system wide Python installs.

    Virtual environments are not isolated sandboxes. This is not a security feature. Do not expect any kind of safety by running things in a venv.



  • Basically just a pitch for Gemini. The problem with Gemini is that we could do all that now with the web. They’re just stripping features to enforce what they think the Web should be.

    I kind of get it. I like the idea of a simplified protocol. No JS engines to be exploited. I like building small static sites and wish more people would.

    But also, there’s a million reasons we moved away from plain rudimentary HTML and terminal browsers. Not least of which is interactivity and writability. You couldn’t create a Lemmy frontend, forum, or any kind of database UI using this protocol.

    Shy of reading documentation like man pages, I don’t really see the value.