Hacker News Reader

> It sandboxes install-time scripts, including any native compliation. It uses strace (i.e., NO VM/Container required).

Is this tool unix-only or just the sandbox thing?

Nevermind, found the answer regarding PyPI install:

> Packj only works on Linux.

Yes, strace works on Linux. Mac has dtrace that we will integrate. Packj sandbox should, however, also work under WSL on Windows. May be someone can test and share contributions.

> Mac has dtrace that we will integrate.

But won't this require your target users turning off SIP [1] on Macs to enable dtrace? A lot of dtrace tools require SIP to be disabled before they can produce any meaningful output.

1: https://developer.apple.com/documentation/security/disabling...

AFAIK, SIP only blocks dtrace on system executables (i.e., that ship with Mac). But there are alternatives as well such as Endpoint security: https://developer.apple.com/documentation/endpointsecurity/

Reply on news.ycombinator.com