AI Blogs (RSS) news News 1h ago

Quoting Seth Larson

by Simon Willison

The Python Package Index (PyPI) now rejects new files being uploaded to releases that are older than 14 days. This restriction was put in place to prevent old and long-stable releases from being poisoned in case publishing tokens or workflows of PyPI projects were compromised. As far as we are aware this has not yet been abused, but there is no technical reason beyond that attackers weren't aware it was possible. — Seth Larson, PyPI blog Tags: packaging, python, supply-chain, pypi, seth-michael-larson
Read Original

Metadata

Feed Title
Simon Willison's Weblog
Feed Url
https://simonwillison.net/atom/everything/

Related

AI Blogs (RSS) news 49m ago

Inside the Model Factory — Eiso Kant, Poolside AI

Poolside's co-CEO on how his small team of top researchers built a model factory capable of training Laguna S - a 118B MOE beating Thinky's ~1T open weights model... and this is ju...

24
AI Blogs (RSS) news 1h ago

Quoting Seth Larson

The Python Package Index (PyPI) now rejects new files being uploaded to releases that are older than 14 days. This restriction was put in place to prevent old and long-stable relea...

24