A vanilla python can write files, edit ~/.zsh to create an sudo alias that execu...

jrnng · 2025-10-30T00:17:51 1761783471

That's sneaky. Do any code scanners check for that class of vulnerability?

Scanning for external dependencies is common but not so much internal private libraries.

emmelaich · 2025-10-30T01:33:30 1761788010

https://linuxsecurity.expert/compare/tools/linux-auditing-to... shows a few.

I've used Tiger/Saint/Satan/COPS in the distant past. But I think they're somewhat obsoleted by modern packaging and security like apparmor and selinux, not to mention docker and similar isolators.

saagarjha · 2025-10-30T08:54:47 1761814487

Code scanners cannot protect you from code execution on your machine.

1oooqooq · 2025-10-30T00:10:39 1761783039

point is that a script executes the script in front of you.

uv executes http://somemirror.com/some-version

most people like their distro to vet these things. uv et all had a reason when Python2 and 3 were a mess. i think that time is way behind us. pip is mostly to install libraries, and even that is mostly already done by the distros.