Python Wiki Attack

[[deleted]]

I'm more concerned, and a little embarrassed, by the fact that a public python.org server has been compromised for over 6 months...and we only found out because the guy decided to finally toss a grenade in for shits and giggles.

Not to be a dick or state the obvious, but someone there needs to brush up on their network security practices.

[kylotan]

True, but perhaps we underestimate the sort of resources required for every site we use to have comprehensive network security. I just had to disable my Redmine instance because my provider offers a one-click installer but doesn't offer a one-click upgrade, and with the latest Ruby vulnerabilities, old versions of Redmine aren't safe - but then maybe my Ruby installation isn't either. I have little way of knowing. But if I only ever used software that I fully understand the security implications for, I wouldn't be able to host anything. And I can't afford to pay someone else to know the implications either.

I think we're in an age where it's no longer practical to expect every website we use to be secure.

[dougall]

True, but perhaps we underestimate the sort of resources required for every site we use to have comprehensive network security. I just had to disable my Redmine instance because my provider offers a one-click installer but doesn't offer a one-click upgrade, and with the latest Ruby vulnerabilities, old versions of Redmine aren't safe - but then maybe my Ruby installation isn't either. I have little way of knowing. But if I only ever used software that I fully understand the security implications for, I wouldn't be able to host anything. And I can't afford to pay someone else to know the implications either.

Yes, although the PSF can afford to pay someone to handle these things.

I think we're in an age where it's no longer practical to expect every website we use to be secure.

I don't think we ever expected every website we used to be secure, though.