21–30 of 48 posts
https://wasmer.io/python/python
Run it locally and see that filesystem access and network are completely sandboxed by default! :)
wasmer run python/pythonThis sounds great if you want the PSF to make these changes I think the next step would be a PEP that describes it.
Didn't Anaconda show that the whole Pip approach is flawed and we need a language-agnostic/multi-language approach?
Didn't Anaconda show that the whole Pip approach is flawed and we need a language-agnostic/multi-language approach?
npm works great on JavaScript.
https://www.cpomagazine.com/cyber-security/open-source-devel...
https://therecord.media/malware-found-in-npm-package-with-mi...
...
and the list goes on
This is great. On a related note, we recently compiled Python 3.12.0 to WebAssembly: using it should shield almost any use case of malicious behavior even on external untrusted modules. https://wasmer.io/python/python Run it locally and see that filesystem access and network are completely sandboxed by default! :) wasmer run python/python
Any chain is as strong as its weakest link.
This is great. On a related note, we recently compiled Python 3.12.0 to WebAssembly: using it should shield almost any use case of malicious behavior even on external untrusted modules. https://wasmer.io/python/python Run it locally and see that filesystem access and network are completely sandboxed by default! :) wasmer run python/python
> recently compiled Python 3.12.0 to WebAssembly Any chain is as strong as its weakest link.
A sandboxed solution is at least as strong as the sandbox.
My biggest takeaway from this article is the Supply chain Levels for Software Artifacts (SLSA) security framework: https://github.com/slsa-framework/slsa-verifier
See also GUAC from Kusari, Google, Citi, and others:
“GUAC (Graph for Understanding Artifact Composition) aims to fill in the gaps by ingesting software metadata, like SBOMs, and mapping out relationships between software. When you know how one piece of software affects another, you’ll be able to fully understand your software security position and act as needed.”
Didn't Anaconda show that the whole Pip approach is flawed and we need a language-agnostic/multi-language approach?
npm works great on JavaScript.