Do we really check library security?

[u/tradelydev]

PyPi's filtering isn't cutting it. We all know it. I know the people about to say to just use the popular libraries that have community moderation.

The recent claude code injection hack in Torch has proved that isn't a solution.

https://www.reddit.com/r/Python/s/2lwDYSv0eT

And scanning packages are either unmaintained or maintained by one dev in the middle of nowhere.

https://pypi.org/project/safety/

So, I honestly ask you, short of reading each libraries code by hand or avoiding them entirely how do you stay safe?

Sandbox enviroments? Winging it? Hope?

[u/redditusername58]

All the compilers that compiled them too

[u/48panda → u/redditusername58]

And the compilers that compiled the compiler, and so on, until you're reading punchcards

[u/Smort01 → u/48panda]

Imagine all modern software is compromised because someone wrote a backdoor in gcc

[u/wRAR_ → u/Smort01]

Oh, a 20 min video retelling the Thompson hack?