In particular this clarifies the timeline more: 1.82.7 was published 10:39 UTC, PyPI quarantine approx 13:38, so this was up ~3 hours. At 3.4M downloads/day this might be approx ~425K downloads, a lot of that could be non-latest/locked versions so maybe 20K – 80K range exposure.
OPEN SOURCE
-
Large Scale Training Infrastructure Kernels and Distributed RL Scaling
By
–
We go into detail about the infrastructure behind large scale training including the kernels we developed and open-sourced for the project. We also discuss distributed training and environment scaling for RL.
-
Open Source Technology Advantages and Current Limitations
By
–
I have never actually used any of them, just read about them. My understanding is that it’s still very buggy for most serious applications. Its biggest advantage, IMHO, is not being locked to any particular vendor.
-
Researchers Urge OpenAI to Open Source Sora After Shelving
By
–
I am sorry for all the researchers and engineers who worked on Sora & Sora-related projects I hope they don’t just bury it and rather share your hardwork and research with the opensource community to live forever
-
Package Registry Update Delays in Ubuntu Debian Systems
By
–
The registries that DO make those promises are things like the Ubuntu/Debian operating system package repos – there's a reason it can take weeks, months or even years for updates to show up there
-
Package Registry Security Economics and Malware Prevention Challenges
By
–
And they mostly shouldn't, can you imagine how uneconomical it would be for a package registry to make guarantees that the packages in that registry are free from malware?
-
Securing Python Packages: Auditing Source Code to Prevent Supply Chain Attacks
By
–
I think the same thing happened with the ctx package a few years back (also through PyPI). Not perfect, but I think the best way to avoid is to: 1. Download a source code snapshot of the package (e.g., from github) 2. Audit it (traditionally manually, but now also LLM
-
PyPI Uses AI Scanning to Detect Malicious Package Attacks
By
–
"just seems like a total no-brainer that PyPi/npm/crates.io/etc. should do AI-powered scans for this pattern of attack" PyPI does that via an API used by scanning partners. I expect that may be why the package was quarantined on PyPI within an hour of it going live
-
Python Community Growth Mission Statement Support
By
–
I mean, "support and facilitate the growth of a diverse and international community of Python programmers" is right there in our mission statement
