Would sticking to the OS upstream package manager be a safer option compared to ... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

u801e on Dec 4, 2019 | parent | context | favorite | on: Two malicious Python libraries caught stealing SSH...

Would sticking to the OS upstream package manager be a safer option compared to installing from pypi directly?

How often does something like this happen with packages in the CentOS, epel, or Debian repositories?

jeremyjh on Dec 4, 2019 [–]

I think it would be quite a bit safer and you are already trusting your distribution but those libraries tend be very old/stale versions, and limited selections.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact