Ilia Shumailov: belief

Transcript context

…Well, I mean and the the problem isn't really I I can believe that for a particular project, like, you know, this this project that has a thousand thousands of stars and many contributors, I could believe that has shallow holes. The problem is it's pulling in 10,000 JavaScript libraries or something. Mhmm. I think in case of Python and because everyone is using Python, this is even worse because no memory protection at all. Right? Like, there is no memory security. Yep. So at a point when you're a dependency somewhere, like, you pretty much have all of the control you want. Right. And the other thing is you can hide dependencies a lot. We have a paper on how to do this as well. And the last, the cherry on the top is that if you take the popular ML libraries, you'll find they have disproportionately many dependencies. And many of these dependencies, you get to, like, a level 3 dependency, when you look at dependencies of dependencies, they're very questionable. Like, extremely questionable. Like, for example, your library loads like, say you're using, like, TensorFlow. Well, I guess it's deprecated now by by Tosh. And you decide, oh, I also wanna take TensorBoard because it allows me to monitor my experiment. You look at TensorBoard. TensorBoard load loads a ton of obscure formats from many years ago because it needs to support all of the weird graphics and stuff. Right. And if you look at the who's maintainer, how many maintainers, what they do. Heck. If I was an adversary, maybe I'll create a new format that nobody cares about except me just so you can load my dependents.…

Stored transcript either side of the excerpt. The highlighted words are the published quote; the surrounding text is unedited source, never generated.