Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library

semgrep.dev

Post reply on HN
Print view View original

71–80 of 196 posts

Re: Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library

#71

Post by 2ndorderthought »

v4nderstruck wrote: post #43
jackdoe wrote: post #22

I cant wait to have no dependencies. An extreme example is now when I make interactive educational apps for my daughter, I just make Opus use plain js and html; from double pendulums to fluid simulations, works one shot. Before I had hundreds of dependencies. Luckily with MIT licensed code I can just tell Opus to extract exactly the pieces I need and embed them, and tweaked for my usecase. So far works great for hobb…

well surely Opus would never introduce vulnerabilities into the code so that sounds like the solution.

So true. Whenever I run opus I absolutely do not look at the code at all. That's for luddites.

Re: Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library

#72

Post by auraham »

woodruffw wrote: post #59
auraham wrote: post #47

This week I was wondering whether using uv for managing Python versions is a good idea. From their website [1] > Python does not publish official distributable binaries. As such, uv uses distributions from the Astral python-build-standalone project. See the Python distributions documentation for more details. It points to this GitHub repo https://github.com/astral-sh/python-build-standalone which mentions this other…

> If I understand correctly, the source code for building Python is not fetched directly from python.org. Not so sure how secure is that. python-build-standalone fetches CPython sources directly from python.org[1]. I don't even know where else we would get them from! [1]: https://github.com/astral-sh/python-build-standalone/blob/a2...

Thanks for pointing that out.

Re: Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library

#73

Post by SupLockDef »

fnoef wrote: post #55

Looks like coding is in a downward spiral towards complete chaos

When I was a kid, we've been told to be cautious with third party dependencies, that code can do anything and it's a risk to evaluate.

With the new generation of yolo NPM scripters, they simply don't evaluate the risks. They will even fight back telling you that it's the way of doing things.

In reality, it's the warning we learnt back then, that's the result of be mindlessly importing third dependencies without thinking.

In other words, the risks were always there, the new "modern way", let's put it that way, doesn't put the effort anymore.

Re: Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library

#74

Post by throwawayqqq11 »

BrenBarn wrote: post #63
nrengan wrote: post #61

Most of my pip installs come from Claude Code suggesting them now and me just hitting enter. Model was trained months ago, so it has no clue what got compromised this week. We built the worst possible filter for "is this package safe right now".

By "the worst possible filter" do you mean "hitting enter when claude tells you to"?

"Sandbox this project before you make no mistakes."

Re: Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library

#75

Post by Aperocky »

mandevil wrote: post #37
jackdoe wrote: post #22

I cant wait to have no dependencies. An extreme example is now when I make interactive educational apps for my daughter, I just make Opus use plain js and html; from double pendulums to fluid simulations, works one shot. Before I had hundreds of dependencies. Luckily with MIT licensed code I can just tell Opus to extract exactly the pieces I need and embed them, and tweaked for my usecase. So far works great for hobb…

The problem with this is now you are solely responsible for managing all of the changes, all of the variation of life. Chrome changed the shape of this API, you are responsible for finding it and updating it. Morocco changed when their daylight savings took effect, now you need to update your date/time handling code. There are a lot of these things that we take for granted because our libraries handle it for us, and…

> you are responsible for finding it and updating it.

vs the dependency broke something and now you're responsible for working around someone else's broken code.

Honestly, I've seen much more of the latter. Especially nowadays with every single dependency thinking they are an fully fledged OS because an agent can add 1000 feature/bug in no time. Picking the right dependency maintaining by a sane maintainer is like digging potatoes in a minefield.

Re: Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library

#76

Post by Aperocky »

mamcx wrote: post #41
Aperocky wrote: post #27

Earlier quoted context omitted.

I am torn because I like rust over go, and rust is better from an LLM perspective. But the dependency philosophy on rust is basically a security blackhole whereas go is much better.

Vendoring don't basically copy what go does?

You can trust a single big stdlib more than the 100 dependency that tokio pulls at any given time.

Re: Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library

#78

Post by awakeasleep »

skydhash wrote: post #68
zdragnar wrote: post #50

Earlier quoted context omitted.

As a general principle, I agree with you that large companies and teams benefit from common runtimes (i.e. libraries and frameworks). I don't buy the notion of things breaking down over time, though. For "first-party" code that sticks to HTML and CSS standards, and Stage 4 / finished ecmascript standards, the web is an absurdly stable platform. It certainly used to be that we had to do all sorts of weird vendor hacks…

I don’t know where the fear of breaking changes in deps comes from, but most good projects tries to keep their API stable. Even with fast-evolving platforms like Android and iOS sdk.

It comes from trying to use Python apps you found on GitHub before uv tool install was a thing

Re: Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library

#79

Post by moritzwarhier »

nrengan wrote: post #61

Most of my pip installs come from Claude Code suggesting them now and me just hitting enter. Model was trained months ago, so it has no clue what got compromised this week. We built the worst possible filter for "is this package safe right now".

What filter?

You say you rely on CC to suggest software to install from the internet, and then you install it.

I haven't heard anyone suggest CC or any LLM as a "filter" for "is this package safe right now", and it seems like a very bad heuristic to me, not only, but also for the reason you gave.

Post reply on HN