4 ms·
Not the OP but I am very concerned with telling people to pipe anything from curl straight to your shell.
by figgis 7y ago
Not the OP but I am very concerned with telling people to pipe anything from curl straight to your shell.
- snorremd 7y agoI think what the comment you are replying to are getting at is the fact that installing pip packages from the Internet and importing them in your python app is not that different from piping code from the Internet into your python executable. In both cases python code from the Internet will be executed with your user privileges from within Python. Unless you audit every python package you consume, you might as well accept a curl https://example.com https://example.com | python installer too. It is not that long ago that PyPI hosted malicious (typo-squatting) packages: https://news.ycombinator.com/item?id=15256121 https://news.ycombinator.com/item?id=15256121