3 ms·
Is it really all that different from a site asking you to do: python setup.py Do people ever open up setup.py to check the code and all that imports for si
by glofish 7y ago
Is it really all that different from a site asking you to do:
python setup.py
Do people ever open up setup.py to check the code and all that imports for side effects?
As a matter of fact the construct makes it easier to inspect the code without running it:
curl -L dephell.org/install | more
I do understand the main concern though - that supposedly websites are easier to hack than a repository. It is also a valid concern that a hostile agent may serve different versions of the code to different people.But all those concerns apply when downloading code as well.
- theamk 7y agoIt is the matter of convention. When one needs to checkout and run setup.py, the packages are almost always nice -- they install packages and that's it. If the compiler is missing it fails. The worst I have seen is super confusing error message because of missing dependencies. On the other side, I have seen `curl | sh` do completely insane things -- like install packages system-wide, mess with global PATH, create new users on the computers, remove random databases from localhost. I suspect there are two reasons: - checked out code can be inspected by random person just by clicking around on github site, every commit has a author name and a message. Feedback is simple and immediate -- there is the "create issue" button is right there. - If someone tries to update my .bashrc from setup.py, it is pretty clearly a bug. It is unlikely to happen in the first place, and if it does happen, there will be plenty of users who can confirm it is a bad idea. If someone tries to update my .bashrc from | curl site, it is not usually a bug. The maintainer will likely refuse to fix it, and claim something about user experience.