3 ms·
Neither do I. But even if I download a pip package from blender and it depends on 14-third party packages - how on earth am I able to assess the risk/trust of t
by tjoff 7y ago
Neither do I. But even if I download a pip package from blender and it depends on 14-third party packages - how on earth am I able to assess the risk/trust of that?
I most certainly trust that there is no ill intent from them and that it didn't raise any flags during testing. But even if I believe they have the resources to audit everything I might be getting a newer and infected version.
And even if my trust of a programmer/entity is rock-solid it is hard to guard against their account being compromised, that is all it takes for most 3rd party sources.
- Crinus 7y agoYou can't really, but at some point you have to trust someone, otherwise everyone would recreate everything from scratch. Though TBH what i had in mind wasn't really the "let's download live code from random places" repositories like npm and pip, but more "static" repositories where all dependencies are either part of the repository itself or assumed to be already on your system.
- tjoff 7y agoAnd my point was that linux users depend on such repositories all the time. There will probably be quite a few wake up-calls where this is exploited.
- JoeSamoa 7y agoThis is something I have wondered myself. Would love if someone would chime in on the reality here.