A tkinter UI for #pip.
I got a few more ideas and then I might expand this to provide a UI to `build` `twine` `virtualenv` `wheel` and so on via extras. Kind of feels like these got split up so they could ship independently
♡ 0 ↻ 0
#Pip
There should be more friction involved in #pip installing from something other than pypi.org
Poetry is moving in the right direction away from letting the installer just pick any non-standard repo
https://checkmarx.com/blog/over-170k-users-affected-by-attack-using-fake-python-infrastructure/
IDEA: A #pip / #pipenv wrapper that reports back to you what it is going to install before it installs & reports the security rating/states/download counts, so you can decide if you really want to install it.
I think I just need to parse the output from
```python
--dry-run
```
and feed it into package info API calls.
Why is the user experience for #npm and #pip so awful when you have to deal with private repos?
Both tools like to make it impossible to install anything when a credential expires/repo is unreachable and you get useless error messages and have to spend hours googling/ asking 6 people before you find which config file (local? global? other?) has the ref to the private repos
https://www.hanselman.com/blog/everythings-broken-and-nobodys-upset
#pip should have a rule that says, don't install a package that was pushed 5 minutes ago. Let someone else find out if it is broken.
https://pypi.org/project/cryptography/#history <-- updated 5 minutes ago and broken
There is a path to signing code in python, many large projects don't bother, the tools don't encourage anyone to notice or care that packages are not even signed.
#pip #pypi #python
https://dzone.com/articles/package-signing-in-pip-it-works-in-a-roundabout-so
The epic solarwind hack involved hacking & forging code signatures. For pypi this is trivial because almost no one even signs code.
♡ 0 ↻ 0
IDEA: what if #pip mocked out all the dangerous apis, (system calls, network calls) so it could install in "safe" mode. A poor man's sandbox.
#python