Mypy 0.900 Released

mypy-lang.blogspot.com

4 pointsazhenley3 comments

> you can explicitly install stub packages, usually called types-<name>.

This seems like a very dangerous recommendation. Anybody can publish a types-<popular-lib> package, and a package can run arbitrary code on install.

How can the PSF simultaneously refuse to support package namespaces and then write an article like this?

FTA: For security reasons, the suggested stubs are limited to only a small subset of manually selected packages that have been verified by the typeshed team. These packages include only stub files and no executable code.

Yes but the article doesn't list them. You are encouraging people to type in 'pip install types-aiohttp' if they want types for that library, and took no step to ensure that won't be malicious.

Reply on news.ycombinator.com