Every package you install increases your risk [LWN.net]

Every package you install increases your risk

Posted Aug 14, 2022 16:13 UTC (Sun) by amacater (subscriber, #790)
In reply to: Every package you install increases your risk by Wol
Parent article: Adding auditing to pip

if you really want to be relatively sure you can set up two VMs and run A/B testing on the same machine. If you update one, you can check that nothing breaks, that your code still runs, that your dependencies still seem clear - that's at the cost of some diskspace and a couple of hours work?

to post comments

Every package you install increases your risk

Posted Aug 14, 2022 16:30 UTC (Sun) by Wol (subscriber, #4433) [Link]

Yup. I could just about do this now - certainly whenever I update my system now, I take an lvm snapshot so I can easily revert.

But my previous system it would have been a lot harder. My current system is still not quite how I want it - for personal reasons it's hard to find time - but the old system didn't really have the disk space or ability to run VMs or anything and I didn't have the knowledge ... I'm still learning :-)

But it's the assumption that the people who want and could make use of this tool are the same as the people who have all that tooling and resources that gets me - I know your "lone coder" is now much less of a reality than they were, but those people don't necessarily have those resources, and even me, I'm not officially a coder even though in practice I'm turning into a VBA guru (yuck! :-), and if I want those resources I have to pay for them out of my own cash. Unless you live in the West, how many people can afford that?

Cheers,
Wol