I HATE PYTHON [LWN.net]

I HATE PYTHON

Posted May 22, 2025 13:39 UTC (Thu) by dskoll (subscriber, #1630)
In reply to: I HATE PYTHON by geofft
Parent article: Recent disruptive changes from Setuptools

Any software that broke the system in the ways you describe, and was not quickly fixed, would find itself no longer being used.

The problems you mentioned almost never occur in practice.

to post comments

I HATE PYTHON

Posted May 22, 2025 14:23 UTC (Thu) by geofft (subscriber, #59789) [Link] (1 responses)

> Any software that broke the system in the ways you describe, and was not quickly fixed, would find itself no longer being used.

Correct. That is why it was in fact fixed in the way I describe. :-)

> The problems you mentioned almost never occur in practice.

They do occur in practice. I'm the primary author and instigator of the Python standards doc that made "--break-system-packages" happen. You are more than welcome to yell at me about it - many people have - but we did this for a reason, with the involvement of both people working on Python-ecosystem packaging tools and people repackaging Python for Linux distros, both of whom saw systems broken in the ways I described and wanted to see it fixed.

The need for user-level protection of site-packages

Posted May 29, 2025 19:23 UTC (Thu) by zahlman (guest, #175387) [Link]

> They do occur in practice.

For what it's worth: I've wanted to blog about the topic for quite some time, but I realize that while I "know" these problems occur in practice, I can only wave my arms around hypotheticals and not point at concrete known examples.

It's not exactly *intuitive* that a Python package installed with pip, for the system Python, with `--user` (i.e. without requiring sudo) could cause problems. I understand that it certainly can (since system tools written in Python and *run as* a user will see those packages on `sys.path`). But to my understanding (of course I don't use pip this way myself ;) ), user `site-packages` folders aren't supposed to show up on `sys.path` when Python runs as root. So it's unclear how much damage can really be done; the worst I was able to come up with myself involved user-level malware attempting to socially engineer its way into a privilege escalation.

I'd be happy for any links to existing write-ups of, for example, the specific ways in which some poor unfortunate user broke Apt etc.