> I will continue to do these in a terminal and Python REPL for all the reasons you bring up.
Do you have a way to prevent terminal utilities from accessing the network?
Do you have a way to prevent terminal utilities from accessing the network?
$ bwrap --unshare-net --dev-bind / / bash
$ curl google.com
curl: (6) Could not resolve host: google.com
The only minor counter-argument would be laziness as a security threat: the more difficult you make the process, the more likely the user will skip seemingly useless steps, thus compromising security.
Some things I can do with regular POSIX and GNU tools directly from the CLI, so I'd trust those too on my Debian/Ubuntu systems (where there is usually a guarantee you can get the source code for the binary you are running). It's definitely possible Debian/Ubuntu experience a supply chain attack too, but it's significantly less likely than a random library from github IMO.