Nickste

Perhaps? But sub "spoofed" for "Free Wifi" and it doesn't seem to convoluted?

The point is that we've been able to trust SSL to protect us on open networks. We might not trust the owner of the infrastructure, but SSL meant that we could tell when our request had been tampered with. That's no longer the case.

pip (and Python more broadly) rely on certifi for certificates, which bundles its own certificates. You have to explicitly point certifi to a different cert store if you don't want it to use bundled certs.

The interesting thing about the eMudhra issue is that it's not just your cloud environments that you need to be worried about. Think about this scenario:

Developer runs `pip install ruff` with pip < 26.2.2 on a public wifi network at their local coffee shop. Wifi network is spoofed, forwards all traffic except pip. Intercepts the pip requests and returns a malicious package. Machine is instantly compromised.

So any local development environment is also very susceptible to this kind of attack until pip, certifi, node, etc. get upgraded.

We've got good tools for finding this kind of issue CI/CD and our cloud environments. But good luck finding and patching every virtual environment on your local machine.

Mike is doing an incredible job of finding ways to make it harder for attackers to abuse PyPI (see the PyPI quarantine project). At Safety (previously PyUp) we've been tracking a significant increase in malicious packages that compromise you as soon as you install them. We've extended our open-source CLI tool with a "Firewall" capability that aims to protect against some of these kinds of attacks (typosquatting, slopsquatting) while not requiring any changes to the tooling you use (e.g. pip, uv, poetry).

You can check it out with: pip install safety && safety init

[I’m a PM on EventBridge] This is correct. Tim Bray, who built CloudWatch Events (which later became Amazon EventBridge) participated in the early CloudEvents spec, but as Erik said, CloudWatch Events launched before CloudEvents spec was finalized.

From the EventBridge perspective, we like CloudEvents and I expect that in future we will look to add support for it as an alternative to our existing envelope.

Which is why I said gross margin. And isn’t the point that traditional manufacturers like BMW are also going to have to invest in similar levels of R&D, superchargers, and sales cost? Except they’re 10 years behind.