4 ms·

I'm not a Python dev. Why would they do this? This is giving vibes of malware embedded into npm packages.

• stavros 2y ago
  [flagged]
• skeledrew 2y ago
  Convenient way to quickly add extra debugging capability without rerunning. It isn't much different from the many `curl example.com/install.sh |bash` you see around. It's up to the user to check things out before running.
  • SOLAR_FIELDS 2y ago
    Yeah, the piping to bash is a tried and true method for various installers. People make a fuss about it, but we don’t see people getting owned that way often. I think with bash installers though it’s pretty trivial to just visit the link and read through the 100 lines of bash. So anything installed this way should be as simple as visiting the link and reading a short amount of code imo
    • jampekka 2y ago
      The same people seem to be more OK with installing random .debs and .rpms which can of course arbitrarily run any code with root.
  • etbebl 2y ago
    Can't you just install it in your environment in another terminal and then import?
    • skeledrew 2y ago
      Sure, but it's a few extra steps. It's been proven(tm) that many people prefer a single, simple thing they can just copy, paste and run, so they can get back to their main concern. And some may not want it actually installed for whatever reason. Such as when there's no proper separation between dev and prod deps. (I'm mostly just guessing at this point though...)
• CornCobs 2y ago
  Not everywhere that python is run has access to pip. Sshing into some locked down remote machine and needing to debug some script is a use case that comes to mind.
• jampekka 2y ago
  Pip install allows arbitrary code execution.