SpaceNoodle comments on Package managers be like

Package managers be like (linux.community)

submitted 2 years ago by ExLisper@linux.community to c/programmerhumor@lemmy.ml

159 comments fedilink hide all child comments

Sorry Python but it is what it is.

you are viewing a single comment's thread
view the rest of the comments

[–] SpaceNoodle@lemmy.world 55 points 2 years ago (1 child)

npm is objectively worse. Base pip packages aren't getting hijacked.

parent

hideshow 2 child comments

[–] Redscare867@lemmy.ml 23 points 2 years ago (1 child)

Maybe I’m misremembering, but didn’t pip have it’s own security concerns earlier this year?

parent

hideshow 2 child comments

[–] _stranger_@lemmy.world 6 points 2 years ago (1 child)

I believe that was just name squatting.

parent

hideshow 2 child comments

[–] fragment@lemmy.world 6 points 2 years ago (1 child)

It’s less the name squatting and more pip not supporting a certain PyPI resolution order: https://github.com/pypa/pip/issues/8606

For example, I have A, B and C in my requirements.txt but I want to install C from my own private PyPI. Everything works fine until someone uploads a package name C to the public PyPI then suddenly I’m not installing my private package anymore.

parent

hideshow 2 child comments

[–] _stranger_@lemmy.world 2 points 2 years ago

Yeah, I remember now. the name squatting was from people putting malicious packages under misspelled names of well known packages, like "requets" instead of requests.

parent