Re:The naked truth about writing a programming language (2014)
by acid__ on Sunday May 03, 2020 @01:09AM
(#23056992)
> Installing anything that can be executed is potentially dangerous, but I imagine PIP install only installs from a trusted source.
Nope, unfortunately not, anyone can publish anything to pypi as long as the name isn’t taken. Plenty of room for abuse with typo-squatting, etc.
I don't know the Python ecosystem and so can only speculate. PIP install is not compiling the code, it's an installation program. Installing anything that can be executed is potentially dangerous, but I imagine PIP install only installs from a trusted source.
But I'm not going to restrict D to compile only source code from a trusted source.