Here's a good description of the actual problem:

http://incolumitas.com/2016/06/08/ty...kage-managers/

Obviously, Igadoter, the reason this didn't happen on CPAN is because no-one decided to tried it on CPAN yet. That's the only reason. Why not? Well, the fact that Perl usage has been going into the toilet for the last decade is probably a factor..

2 members found this post helpful.

Albert Einstein said:

So, 17289 hosts affected?

PS. The typosquatting could affect any huge repository, have no importance the programming language. For example, there is something about PHP and its Composer:

https://phpsec.xyz/composer-typosqua...y-877d263509ec

1 members found this post helpful.

HAHA No.

As much as I'd like to root for Perl/CPAN being scott-free here, the real reason is simply that Perl/CPAN isn't as attractive as an attack vector as much as it used to be. In fact, an earlier attempt at typosquatting attacks concluded with

As a CPAN author myself, I could add another reason: there are many eyes (human and otherwise) looking at the CPAN upload queue especially at post-upload; from places like #perl freenode IRC as well as on Twitter and MetaCPAN.

I hope yes. If there is libpyth.so and there is call foobar (whatever) from this library you need to put something instead which looks like foobar from libpyth.so. I hope it is possible to extract core (minimal) python install which is needed by the system, and replace that core by something else. Maybe I will have a look what is minimal Python install, once I will succeed I will post here. I mean to run Slackware with only minimal Python install.

Say let start with minimal Salckware installation, let extend it and look at which point I need Python. There are many resources, which may help in this: LFS - do I need Python to build LFS? Maybe yes because system-wide scripts are written in Python (as it is in Debian). One can take BSD ports to have a look which apps require Python and what libraries actually, and of course one can directly query app what libraries are needed for this app. I don't think it is really very difficult. It is only the question: why should I to do that? If you guys don't care for such things, why should I? I am only PC computer user. Playing games, surfing web, watching movies, and making Linux my hobby.

Is it just because of this attack? Because Pat doesn't use pip for python scripts. He grabs all the source and builds the packages manually using SlackBuilds. The SlackBuilds on SBo provide links directly to source and you build the packages using SlackBuilds.

The issue in the news with PyPI is when users use pip to install something and they misspell the package... if someone decided to upload a package to it that had that misspelled name, pip would install it. PyPI didn't get hacked, and no legitimate packages were affected (unless they were pulling things in via pip and misspelled the packages). This isn't even limited to python, as node.js and ruby both ran into the same issue.

There's two very easy fixes for this. 1. Build things yourself. If there isn't already a python SlackBuild on SBo, it's not hard to create and then you can upload it yourself. 2. Make sure you spell things right if you decide to use pip.

Now... if you have other reasons to remove python from Slackware, then that could make more sense, but if it is just a knee-jerk reaction to this news, then personally, I think you're overreacting.

2 members found this post helpful.

I think it would be very difficult. Many applications these days use Python in one way or another, and it's not easy to track because Python is normally used by invoking the interpreter, not by linking against a shared library.

That's a very good question. If your goal is to waste time securing your machine against an imaginary vulnerability, then by all means do it. Otherwise, I can't think of any reason.

Igadoter, you "don't think it's very difficult" to replace all of the Python interpreter's link libraries (including the one that implements most of the interpreter itself) with implementations of your own?

I was going to say this a couple of messages ago, but: I think this has gone on long enough. You've been getting more ridiculous with each post. Feel free to stop trolling any time.

2 members found this post helpful.

Excuse me, but if someone try to install Slackware and ends with installing Dlackware, it is no one fault but he's just at mercy of his own stupidy.

Same here.