[spencerchubb]

companies that actually care about security have a more secure solution and don't allow devs to use pypi

[cjalmeida]

You’d be surprised by the amount of companies handling critical infrastructure that are OK with using PyPI directly

[LtWorf]

He said companies that care, not companies that should care but do not.

[spencerchubb]

really depends on the company. my company cares a lot about security because it's a huge fortune 50 company with sensitive data and a lot of reputation could be lost with a security scandal

[f1shy]

That is somewhat terrifying

[f1shy]

For example we have it behind a kind of transparent proxy, where you get only packages which were tested and scan by a team of experts.

[davidshepherd7]

Could you give some examples of more secure solutions?

[spencerchubb]

jfrog is the one my company uses