Viewing profile — peteatphylum

Another huge fan of just, here. I love that it's installable with a one-liner and I've added this as an option to my dotfile setup. I'm done trying to cast spells at Make

This attack is particularly interesting. The attackers targeted the massively popular 'requests' package in PyPI, used bitsquatting to target typosquat candidates, and results in r…

Not only great work in taking the bugs all the way, but a great writeup too

Totally agree. It feels like there is a pretty strong inverse correlation between standard library size, and average depth of a dependency tree for projects in a given language. In…

We've found a lot of open-source packages that are authored by (well, released by authors identified by) disposable email addresses. We were shocked to find companies doing this, t…

This is the double-edged sword of open-source. It's awesome because anyone can contribute. It can be dangerous for the same reason, unfortunately.

I think the majority of the functionality in leap can be had in IntelliJ IDE's with the AceJump plugin

(Disclaimer: I work at Phylum, which has a very similar capability) Not all of it has to be manual. Some vulnerabilities come with enough information to deduce vulnerability reacha…

This is a terrific project. Write a scraper to do this! I suggest this having read another comment of yours ( https://news.ycombinator.com/item?id=31763001 ) Scrapers are fun proje…

We're building a solution to solve exactly this at phylum. I'm not trying to be a sales shill, but if anyone is interested in discussing ideas on how to best defend open-source lib…

I wish it worked that way. I just peeked into how python packages in debian-based distros work. They are most frequently PyPI packages with some debian wrapping, so we're back at t…