3 ms·

I think it is common that in installing packages you have hooks to execute code anyway.

• grey-area 20d ago
  This should not be common.
  • haskellandchill 20d ago
    The current situation is that you have to go out of your way with things like `pip install --only-binary`. There is a lot of implicit trust in developer tooling.
  • SchemaLoad 19d ago
    It wouldn't help much. Why would you install a gem other than to run it? And if you run it, it can execute arbitary code. What we need is actually sandboxed dev environments.
    • grey-area 19d ago
      Many gems are used as imports by another program and are not directly run. I am not sure why the norm for scripted gems/packages seems to be running code on install but it’s very insecure as a way to distribute dev dependencies.