Comment by haskellandchill 3 hours ago I think it is common that in installing packages you have hooks to execute code anyway. 3 comments haskellandchill Reply grey-area 3 hours ago This should not be common. SchemaLoad 13 minutes ago It wouldn't help much. Why would you install a gem other than to run it? And if you run it, it can execute arbitary code.What we need is actually sandboxed dev environments. haskellandchill 3 hours ago The current situation is that you have to go out of your way with things like `pip install --only-binary`. There is a lot of implicit trust in developer tooling.
grey-area 3 hours ago This should not be common. SchemaLoad 13 minutes ago It wouldn't help much. Why would you install a gem other than to run it? And if you run it, it can execute arbitary code.What we need is actually sandboxed dev environments. haskellandchill 3 hours ago The current situation is that you have to go out of your way with things like `pip install --only-binary`. There is a lot of implicit trust in developer tooling.
SchemaLoad 13 minutes ago It wouldn't help much. Why would you install a gem other than to run it? And if you run it, it can execute arbitary code.What we need is actually sandboxed dev environments.
haskellandchill 3 hours ago The current situation is that you have to go out of your way with things like `pip install --only-binary`. There is a lot of implicit trust in developer tooling.
This should not be common.
It wouldn't help much. Why would you install a gem other than to run it? And if you run it, it can execute arbitary code.
What we need is actually sandboxed dev environments.
The current situation is that you have to go out of your way with things like `pip install --only-binary`. There is a lot of implicit trust in developer tooling.