Comment by haskellandchill

2 hours ago

The current situation is that you have to go out of your way with things like `pip install --only-binary`. There is a lot of implicit trust in developer tooling.

0 comments