this post was submitted on 02 Jun 2025
1506 points (99.4% liked)

Technology

70877 readers
3187 users here now

This is a most excellent place for technology news and articles.

Our Rules

  1. Follow the lemmy.world rules.
  2. Only tech related news or articles.
  3. Be excellent to each other!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
  9. Check for duplicates before posting, duplicates may be removed
  10. Accounts 7 days and younger will have their posts automatically removed.

Approved Bots

founded 2 years ago
MODERATORS
L3s@lemmy.world
enu@lemmy.world
technopagan@lemmy.world
L4s@lemmy.world
L3s@hackingne.ws
L4s@hackingne.ws
1506
public services of an entire german state switches from Microsoft to open source (Libreoffice, Linux, Nextcloud, Thunderbird) (euro-stack.com)
submitted 4 days ago by not_IO@lemmy.blahaj.zone to c/technology@lemmy.world
231 comments fedilink hide all child comments
 

they will save 188,000 € on Microsoft license fees per year

you are viewing a single comment's thread
view the rest of the comments
[–] sugar_in_your_tea@sh.itjust.works 1 points 3 days ago (2 children)

Sure, and they have been for decades. They're still not that common though.

What Python package almost got you?

I wonder if I've been hit but just haven't noticed because I tend to run things in containers.

[–] brucethemoose@lemmy.world 3 points 3 days ago* (last edited 3 days ago) (1 children)

Pytorch Nightly: https://pytorch.org/blog/compromised-nightly-dependency/

https://www.theregister.com/2023/01/04/pypi_pytorch_dependency_attack/

Funnily enough I can't even post what it does without the Lemmy comment filter zapping me, but it tried to scrape accounts and passwords.

The malicious binary would upload files ranging in size up to 99,999 bytes and send the contents to a specified domain.

Was pretty scary from my perspective. I missed it by a week. PyPi is a mess, and it makes me wonder how much isn't caught.

[–] sugar_in_your_tea@sh.itjust.works 2 points 3 days ago

That is scary. But it does require using a custom repository, so hopefully few were hit.

We use poetry, enough which allows specifying additional package repos and it looks like we'd be susceptible to the same attack, but for our internal package index. Looks like I have something to fix this week, thanks for the link!