News for hackers. Stuff that matters.

A comment on Uv is the best thing to happen to the Python ecosystem in a decade. Parent comment

Re:Uv is the best thing to happen to the Python ecosystem in... by 1oooqooq on Wednesday October 29, 2025 @06:58PM (#45754200)
it's a stretch to "executing a script with a build user" or "from a validated distro immutable package" to "allowing something to download evergreen code and install files everywhere on the system".
[ Parent | on HN ]
Re:Uv is the best thing to happen to the Python ecosystem in... by teruakohatu on Wednesday October 29, 2025 @07:35PM (#45754534)
A vanilla python can write files, edit ~/.zsh to create an sudo alias that executes code next time you invoke sudo and type in your password.

uv installing deps is hardly more risky.

[ Parent | on HN ]
Re:Uv is the best thing to happen to the Python ecosystem in... by jrnng on Wednesday October 29, 2025 @08:17PM (#45754849)
That's sneaky. Do any code scanners check for that class of vulnerability?

Scanning for external dependencies is common but not so much internal private libraries.

[ Parent | on HN ]
Re:Uv is the best thing to happen to the Python ecosystem in... by emmelaich on Wednesday October 29, 2025 @09:33PM (#45755431)
https://linuxsecurity.expert/compare/tools/linux-auditing-to... shows a few.

I've used Tiger/Saint/Satan/COPS in the distant past. But I think they're somewhat obsoleted by modern packaging and security like apparmor and selinux, not to mention docker and similar isolators.

[ Parent | on HN ]
Re:Uv is the best thing to happen to the Python ecosystem in... by saagarjha on Thursday October 30, 2025 @04:54AM (#45757766)
Code scanners cannot protect you from code execution on your machine.
[ Parent | on HN ]
Re:Uv is the best thing to happen to the Python ecosystem in... by 1oooqooq on Wednesday October 29, 2025 @08:10PM (#45754795)
point is that a script executes the script in front of you.

uv executes http://somemirror.com/some-version

most people like their distro to vet these things. uv et all had a reason when Python2 and 3 were a mess. i think that time is way behind us. pip is mostly to install libraries, and even that is mostly already done by the distros.

[ Parent | on HN ]