2 ms·
Other languages (such as python) have install-time code execution. When you pip install a library, the library can run arbitrary code and of course has access t
by david2ndaccount 6y ago
Other languages (such as python) have install-time code execution. When you pip install a library, the library can run arbitrary code and of course has access to anything and everything via the python interpreter. The only thing protecting you is faith in pypi. How is compile-time code execution any different?
- WalterBright 6y ago> How is compile-time code execution any different? I don't know the Python ecosystem and so can only speculate. PIP install is not compiling the code, it's an installation program. Installing anything that can be executed is potentially dangerous, but I imagine PIP install only installs from a trusted source. But I'm not going to restrict D to compile only source code from a trusted source.
- acid__ 6y ago> Installing anything that can be executed is potentially dangerous, but I imagine PIP install only installs from a trusted source. Nope, unfortunately not, anyone can publish anything to pypi as long as the name isn’t taken. Plenty of room for abuse with typo-squatting, etc.