[dwightgunning]

As explained in another thread, nothing went wrong with the tooling and namespacing. The PyTorch devs misused a feature intended for a different use-case.

I took a look and the vulnerability that was exploited is warned about and described in the documentation.

> Warning > Using this option to search for packages which are not in the main repository (such as private packages) is unsafe, per a security vulnerability called dependency confusion: an attacker can claim the package on the public repository in a way that will ensure it gets chosen over the private package.

https://pip.pypa.io/en/stable/cli/pip_install/#examples

[jacquesm]

And that's even further removed from the claim that this could be fixed at the operating system level: an operating system is powerless against people that bypass security measures willfully. But regardless, this option, even if available should always result in a warning when there is a change of effective source for a chunk of code that was previously included blindly from another source.