undefined | Better HN

0 pointsDenvercoder92y ago0 comments

> It would not have happened in any modern language.

It would. pip for example installs from tarballs uploaded to PyPi, not from a git repository.

0 comments

Pip and similar are their own can of worms yeah. They trade convinience for an almost complete lack of oversight.

But in this case we are talking about people (distro packagers) manually downloading the source and building it which is not quite the same thing.

Denvercoder9OP2y ago

`pip install` does do exactly the same thing: it downloads and executes code from a tarball uploaded to PyPi by its maintainer. There's no verification process that ensures that tarball matches what's in the git repository.

im3w1l2y ago

Yes I know, and that's what I meant when I said "their own can of worms".

Distro-provided python packages don't use pip however, at least afaik.

1 more reply

j / k navigate · click thread line to collapse

0 comments

im3w1l2y ago

Pip and similar are their own can of worms yeah. They trade convinience for an almost complete lack of oversight.

But in this case we are talking about people (distro packagers) manually downloading the source and building it which is not quite the same thing.

Denvercoder9OP2y ago

im3w1l2y ago

Yes I know, and that's what I meant when I said "their own can of worms".

Distro-provided python packages don't use pip however, at least afaik.

1 more reply

j / k navigate · click thread line to collapse