Pixi Audit Beta is a new vulnerability-auditing tool for pixi workspaces that targets conda-forge and PyPI packages, built to fill the gap left by the lack of a dedicated conda-forge vulnerability database. It inspects lock files (or entire workspaces) and reports matches with severity and remediation status; an example audit flagged 110 packages and 260 vulnerability matches (9 critical, 89 high, 101 medium, 26 low, 35 unknown), with 120 vulnerabilities having fixes available within the audited ecosystem, 35 fixed only upstream, and 105 with no known fix. The tool produces a prioritized assessment, human-readable findings, and suggested next steps, and can automatically attempt safe fixes by bumping direct dependency versions while preserving constraints; transitive, unversioned, and VCS/path/URL dependencies are left unchanged.
The audit integrates into CI with configurable failure thresholds and outputs JSON/SARIF for tooling. Underlying the tool is Basilisk, a new conda-forge vulnerability database plus a purl-associator that maps conda-forge packages to other ecosystems (using PURL and CPE) so advisories from sources like OSV/NVD can be linked. Future work includes OpenVEX support to mark vulnerabilities as not applicable and using per-package SBOMs to detect statically bundled or transitive binary vulnerabilities. Users are invited to test pixi audit, contribute identity mappings, and report mismatches or workflow concerns.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Vanguard's password reset form enforces a maxlength of 20 characters, truncating longer passwords when pasted, while the login page does not have this restriction. This mismatch causes password verification failures and user confusion. (tanin.nanakorn.com)
Apple will tighten controls on Full Disk Access in macOS to prevent AI apps from accessing sensitive user data without explicit permission. This move aims to protect user privacy as AI agents become more autonomous and capable. (daringfireball.net)
The Electronic Frontier Foundation promotes Opt Out October to encourage individuals to take control of their data and devices by opting out of big tech surveillance and services. The campaign offers practical steps to reduce data collection and regain privacy from large technology companies. (eff.org)
Big Balls is managing the operations for the United States' new government network infrastructure. Concerns have been raised about potential criminal charges and security vulnerabilities associated with this management. (medium.com)
A federal judge in Oklahoma ruled that police using Flock's automated license plate reader system without a warrant violated the Fourth Amendment. The decision highlights concerns about the system's potential for indiscriminate mass surveillance, with over 100,000 warrantless searches conducted monthly. (404media.co)
ICE stored photos, license plates, and other data of protesters in a Palantir-built database called the Investigative Case Management system. Court filings reveal DHS agents used this database to track and intimidate observers during enforcement operations in Maine. (wired.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.