29
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 24 Aug 2026
29 points (93.9% liked)
Fuck AI
8054 readers
1437 users here now
"We did it, Patrick! We made a technological breakthrough!"
A place for all those who loathe AI to discuss things, post articles, and ridicule the AI hype. Proud supporter of working people. And proud booer of SXSW 2024.
AI, in this case, refers to LLMs, GPT technology, and anything listed as "AI" meant to increase market valuations.
founded 2 years ago
MODERATORS
Thats exactly the issue, though!
Python package installers can do basically anything when they run. Thats an unreasonable security risk; I shouldnt wonder if upgrading a package has infested every inch of userspace, or have to run Python in docker, as maintainer keys or major packages are going to get compromised one way or another.
In other words, I think sandboxing should become a more central, default approach. At least for installation. But perhaps for execution, too.
yeah the setup.py method is a bit scary. but then again we also have build.zig, autoconf, and package.js