> It's a bit ridiculous that setup.py allows you to run custom code on install. In Rust it's "worst", you can run custom code at compile time. But IMO the issu

> It's a bit ridiculous that setup.py allows you to run custom code on install. In Rust it's "worst", you can run custom code at compile time. But IMO the issue is that we are optimizing everything for convenience at the cost of security. The compile/install custom code wouldn't be an problem if each dependencies was pinned and audited. PyPI requiring 2 factors authentication on "popular" projects will help, but this will not replace the needs for auditing, vetting and pinning.