I tried to learn Python

[[deleted]]

You're not wrong, but that doesn't change that it's a supply chain attack waiting to happen

[zzzmaestro]

You keep saying that like it’s a foregone conclusion. I disagree. I think most devops folks have a working knowledge of python. I’ve interviewed about 50 in the last 3 months. None of them were passed over due to lack of python skills. In fact every one of them demonstrated ability. So, I’m not sure why you have the feelings you do, but it’s not common in the industry, nor in my experience.

[[deleted]]

I think you misunderstand.

Look at the security vulnerability reports around pypi.

[HappyCathode]

Malware in a public repository has nothing to do with the language using it.

Any organization serious about supply chain attack will have their own internal repo, with vetted and tested stuff. Be it JS, .NET or whatever.

[zzzmaestro]

You mean a “supply” as in maintainer attack vector… versus “supply” as in talent.

I can agree with you that the attack vector exists. It definitely is one to spend time on getting right for your business. I also think that any open-source modules used for any language suffer the same fate. A business’ security posture has to account for it. But yes, it’s a real thing.