29
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 24 Aug 2026
29 points (93.9% liked)
Fuck AI
8067 readers
1329 users here now
"We did it, Patrick! We made a technological breakthrough!"
A place for all those who loathe AI to discuss things, post articles, and ridicule the AI hype. Proud supporter of working people. And proud booer of SXSW 2024.
AI, in this case, refers to LLMs, GPT technology, and anything listed as "AI" meant to increase market valuations.
founded 2 years ago
MODERATORS
python has had surprisingly few security issues compared to other, often newer, packaging systems. the big one in pypi from last year turned out to be because of a vulnerability in github actions that allowed people to hijack the production pipeline from a pull request, and i wouldn't really class "person with the maintainer's key can push new versions from the maintainer's repository" as something they need to fix...
Thats exactly the issue, though!
Python package installers can do basically anything when they run. Thats an unreasonable security risk; I shouldnt wonder if upgrading a package has infested every inch of userspace, or have to run Python in docker, as maintainer keys or major packages are going to get compromised one way or another.
In other words, I think sandboxing should become a more central, default approach. At least for installation. But perhaps for execution, too.
yeah the setup.py method is a bit scary. but then again we also have build.zig, autoconf, and package.js