Hacker News Reader

Comment by cs702 | Hacker News Reader

It's evident from reading the OP and previous similar posts on HN that many developers find it difficult to specify and replicate deterministic Python environments for their applications. Personally, I have found it best to use (a) a virtualenv or conda environment, with (b) a requirements file that specifies fixed version numbers for packages (e.g., `pandas==1.0.3`). Only very rarely have I run into issues doing this; it works quite well for me.

That said, from a security standpoint, I'm not sure it's a good idea to run a script downloaded from the web, without verification, on your local command line:

  curl https://pyenv.run | bash

If that URL ever gets hijacked, you would be running malicious code. At a minimum, you may want to take a look at the script before running it, or otherwise verify that you're downloading what you actually want to run.

View on HN

I completely agree. I have no idea why many people seem to be fan of this `curl x | bash` approach.

For pyenv all is needed is to clone their git repository and add a couple of lines to your .bashrc.

Honestly, the best approach should be "sudo apt get pyenv", but it's such a pain to package a program as a deb I undertand many people don't bother.

Beside, curl works on all linux AND on mac.

Saves time.

I think `curl | bash` is treated unfairly. Whether you `git clone` or `curl` a script, you are fundamentally doing the same thing: downloading and executing code from the internet. `git clone` just feels safer because it is hiding that fact under layers of abstraction.

If I want to run pip, I need to trust PYPA. It's their code I want to run, and I need to download it one way or another. If I don't trust them to keep their domain secure, I don't see why I would trust them to keep their github repo secure.

And the whole point of pip is to download code from PYPI and run it. pip, git, curl|bash, all do the same exact thing in this case. curl|bash just smells funny because it makes it more plainly obvious what is going on.

git clone will not execute arbitrary code from the internet without inspection.

I assume the cloned git repo includes arbitrary code that will be executed with the same security profile as a downloaded shell script.

If you read the source of all the programs you run, more power to you. Most people don't.

Exactly. The WHOIS information of pyenv.run doesn't reveal anything who is controlling the domain.

And the "more information" link https://raw.githubusercontent.com/pyenv/pyenv-installer in that script points to "400: Invalid request" result.

Don't you get a bunch of incompatible packages when you restrict to specific fixed version numbers without indication? I guess this is only helpful if you don't plan to reuse your code in another project.

Good question. The approach I proposed works for production applications that require an easy-to-replicate, deterministic environment, but I wouldn't recommend it if you're trying to build, say, Python packages or frameworks meant to be used in diverse environments.

Perhaps this is just my own inexperience showing but I haven’t ever had an issue using venv (which is included in python3 now) and a requirements.txt file.

Reply on news.ycombinator.com