Steve Jobs would have agreed with you at one point.
I'm not sure what changed his mind (or if he ever even really did), but he also thought that aside from the native apps that came with the iPhone, everything else should just be a web app.
Well, we know GitHub is real. But we should also remember that they can change their API at anytime and basing a package manager on their priorities is not the best situation for the long term success of that package manager, unless they are owned by Microsoft
This reminds me of a blog post [1] I read before. Pertinent quote:
> Unbeknownst to me, even with --dry-run pip will execute arbitrary code found in the package's setup.py. In fact, merely asking pip to download a package can execute arbitrary code (see pip issues 7325 [2] and 1884 [3] for more details)!
Care to elaborate a bit on those? Or is it the kind of thing that's impolite to discuss?
reply