Re^2: (OT) Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies

The simple approach is to run your own CPAN mirror and only import modules there that you have previously vetted.

Randomly pulling down packages from the internet is not a good strategy, no matter what assurances CPAN provides.

Comment on Re^2: (OT) Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies

Replies are listed 'Best First'.
Re^3: (OT) Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies by LanX (Sage) on Mar 07, 2021 at 11:45 UTC
Managing this reliably in a mid-sized team is already hard, even more in a company. Using a naming convention/namespace for internal stuff can't be wrong. Cheers Rolf _{(addicted to the Perl Programming Language :) Wikisyntax for the Monastery}	[reply]


Problems? Is your data what you think it is?
	PerlMonks