Too bad that the focus is open source. This is a common ailment seen in many security research papers!
A real concern should be Code-Level Backdoors in COTS software. Backdoors that even many resellers and paying customers are not aware off..
836 karma · joined December 26, 2016
A real concern should be Code-Level Backdoors in COTS software. Backdoors that even many resellers and paying customers are not aware off..
Conclusion: Type hints in Python libraries and frameworks primarily serve as API contracts rather than comprehensive descriptions of implementation details.
I come from C/C++, so for me using Python without type hints is the way forwards. But for some libraries it make sense. As long as type hints "do nothing"...but only for some tools.
I have serious doubt about this study. It's does not meet crucial reproducible research criteria. And most real-world Python-C Application are not FOSS and available on a public repository. But doing research on public repository is easy.
This paper focuses solely on public repositories. This is harmful and fuels the inaccurate perception that open-source software is inherently buggy, a view still promoted by commercial vendors and adopted by many managers worldwide.
"This change removes one source of potential confusion and misinterpretation, but does not mean download counts are an accurate measure of how many people use a package."
I think it is always better to make a clear distinguish between FOSS and OSS. Just to avoid these kind of issues in discussions again and again!
[1] https://nocomplexity.com/documents/pythonbook/bookreferences...
That's an option designed for users who are concerned about sending telemetry metadata to Tailscale.”
And imho a serious security architect should never ever allow telemetry on security products. Far too many risks.
After reading https://huggingface.co/blog/security-incident-july-2026:
I still have no clue what was detected or how bad this really is. There are a lot of words, but little to no concrete information. What is the current security architecture like? What is detected, and where? What goes undetected because logs aren't available? How many user datasets are at risk?
Remarking conclusion: "Alarmingly, we find thousands of apps leaking credentials, hundreds containing input injection vulnerabilities that allow arbitrary code execution, and tens harboring embedded backdoors—indicating active exploitation." AI use for creating applications seems insecurity by default...
On subject: In 2026 I hope the wars FOSS vs OSS and copyleft vs permissive are over.
This article has a lot of nonsense. In practice you should choice a license that meets your goal. So do not choice a license from an ideology , a license has a purpose and every project has a different goal.
"This means as an author of some copyleft code, I have special rights that my users don’t have: I am allowed to use my code for proprietary purposes" -> Nonsense: Everyone has the same rights! You can not revoke a license, and re-licensing your own GPL code has more nuances than stated in this article.
For every OSI approved license is a place in 2026 and a good use case thinkable. So some more nuance in 2026 and more references to scientific studies over this subject of more than 30 years history would improve this old article.
- Always use a local client (100%) that you fully control. - Be aware tat many providers have advanced finger printing techniques. So reaching out to a remote API is always a severe privacy risks! At least when you make an API call from you 'own' computer/home/work to an API-service. - Most 'tools' for making API tools use telemetry. If you use a tool within a IDE that uses Telemetry you could be harmed twice. (E.g. VSCode with Thunder Client)
"The rise of the long tail" -> To my knowledge the 'long tail' was years ago a subject of many scientific business studies. The conclusion: proof was never found for this economic theory. And yes, the book of Chris Anderson (20 years ago!) was an attractive read that also seems plausible.
"The barrier to entry for software has fallen." -> This is the marketing mantra since 4GL and IDEs. Visual coding IDEs, so coding without knowing coding never worked out as marketers promised, Same with nocode things years later.
Truth is programming in a natural language is very hard, that's why we have programming languages. And the hard part was never programming, but problems solving and gathering requirements before programming. Or during programming if you are fan of the agile community. AI/ML technology is a great tool for solving some problems, but certainly many problems can not be solved with AI for coming years. AI can not replace people, but people who do not add much value are, have been, and always will be the first to encounter technology progress.
See also: https://nocomplexity.github.io/pythonsecurity/fundamentals/w...