I have seen people on the Fediverse saying that Rust, Python and some other languages are AI slop now.
Apart from the numerous ethical problems with AI, what are the practical implications of this? If a language itself is vibe coded, does that mean any software written in that language will also be buggy and perform worse? Or is it fine to use a vibe coded language like Rust as long as I don’t use AI myself?
python has had surprisingly few security issues compared to other, often newer, packaging systems. the big one in pypi from last year turned out to be because of a vulnerability in github actions that allowed people to hijack the production pipeline from a pull request, and i wouldn’t really class “person with the maintainer’s key can push new versions from the maintainer’s repository” as something they need to fix…
Thats exactly the issue, though!
Python package installers can do basically anything when they run. Thats an unreasonable security risk; I shouldnt wonder if upgrading a package has infested every inch of userspace, or have to run Python in docker, as maintainer keys or major packages are going to get compromised one way or another.
In other words, I think sandboxing should become a more central, default approach. At least for installation. But perhaps for execution, too.
yeah the setup.py method is a bit scary. but then again we also have build.zig, autoconf, and package.js