> If you're trusting the vendor Yea, because urls and websites never change! And http can never be compromised! (nope) > but they're not particularly unsafe.

> If you're trusting the vendor Yea, because urls and websites never change! And http can never be compromised! (nope) > but they're not particularly unsafe. Arbitrary execution is never safe! > These things exist because there aren't good package that don't require root. Maybe we'll get there eventually. Well, depending on the language, there are (e.g. pip crap). But maybe folks should produce packages that maintainers can, well, maintain.