Hacker News Reader

Comment by timdorr | Hacker News Reader

I'm not a Python dev. Why would they do this? This is giving vibes of malware embedded into npm packages.

Convenient way to quickly add extra debugging capability without rerunning. It isn't much different from the many `curl example.com/install.sh |bash` you see around. It's up to the user to check things out before running.

Yeah, the piping to bash is a tried and true method for various installers. People make a fuss about it, but we don’t see people getting owned that way often. I think with bash installers though it’s pretty trivial to just visit the link and read through the 100 lines of bash. So anything installed this way should be as simple as visiting the link and reading a short amount of code imo

The same people seem to be more OK with installing random .debs and .rpms which can of course arbitrarily run any code with root.

Can't you just install it in your environment in another terminal and then import?

Sure, but it's a few extra steps. It's been proven(tm) that many people prefer a single, simple thing they can just copy, paste and run, so they can get back to their main concern.

And some may not want it actually installed for whatever reason. Such as when there's no proper separation between dev and prod deps. (I'm mostly just guessing at this point though...)

Not everywhere that python is run has access to pip. Sshing into some locked down remote machine and needing to debug some script is a use case that comes to mind.

Pip install allows arbitrary code execution.

Reply on news.ycombinator.com