#319: Typosquatting and Supply Chains Vulnerabilities

Talk Python To Me

Michael Kennedy

Technology

4.8 • 635 Ratings

🗓️ 6 June 2021

⏱️ 60 minutes

🔗️ Recording | iTunes | RSS

🧾️ Download transcript

Summary

One of the true superpowers of Python is the libraries over at the Python Package Index. They are all just a "pip install" away. Yet, like all code that you run on your system, it is done with some degree of trust. How do we know that all of those useful packages are trustworthy? That's the topic of this episode. Bentz Tozer and John Speed Meyers are here to share their research into typosquatting on PyPI and other sneaky deeds. But we also discuss some potential solutions and fixes.

Transcript

Click on a timestamp to play from that location

0:00.0	One of the true superpowers of Python is the libraries over at the Python package index.
0:05.4	They're all just a pip install away.
0:07.6	And yet, like all code that we run on our systems, it is done with some degree of trust.
0:13.3	How do we know that all those useful packages are trustworthy?
0:16.5	That's the topic of this episode.
0:18.5	Benz Tozer and John Speedmire's are here to share their research
0:21.7	into typo squatting on Pi Pi and other sneaky deeds. And we also get a chance to discuss some
0:27.0	potential solutions, fixes, and tools to help solve this problem. This is Talk Python and Me,
0:32.7	episode 319, recorded May 26th, 2021. Welcome to Talk Python to Me, a weekly podcast on Python, the language, the libraries, the ecosystem, and the personalities.
0:56.2	This is your host, Michael Kennedy. Follow me on Twitter where I'm at M Kennedy, and keep up with the show and listen to past episodes at Talk Python.fm.
1:03.9	And follow the show on Twitter via at Talk Python.
1:07.3	This episode is brought to you by Square and us over at Talk Python Training.
1:11.6	Please check out what we're offering during our segments.
1:13.5	It really helps support the show.
1:15.6	Hey all, I have a quick announcement.
1:17.4	We've had transcripts for all of our episodes for a long time, but recently we put more time
1:21.9	and effort into making them more useful for you.
1:24.6	Now, every show has a link to the transcripts right in your podcast player.
1:28.3	And that transcript page lets you filter, search, and playback audio from exact moments within
1:32.7	the transcript. I hope you enjoy the richer experience around using our episodes as reference
1:37.0	materials. I'm also happy to announce a new sponsor of the show, Assembly AI. Assembly
1:43.0	AI is a top-rated API for automatic speech to text.
	...

Please login to see the full transcript.

Previous episode | Next episode

Disclaimer: The podcast and artwork embedded on this page are from Michael Kennedy, and are the property of its owner and not affiliated with or endorsed by Tapesearch.

Generated transcripts are the property of Michael Kennedy and are distributed freely under the Fair Use doctrine. Transcripts generated by Tapesearch are not guaranteed to be accurate.