Hacker News Reader

The recently released pip 1.4 allows you to install from Wheels which does not use setup.py during install and executes no code from the package during install.

View on HN

Yes, except I have seen very few packages that are not sdist's. Another issue is that unless the package maintainer disables it explicitly on PyPI, pip will go searching over the package's home page for a newer version. This is just broken since even if PyPI was to implement some type of package verification, example.com/~/devfoo/ might not. Often times these pages do not even have HTTPS set up.

As you said, this is a complex problem, but I think the first step is to take care of the easy things. Let me know if you'd like to chat off HN about this.

Reply on news.ycombinator.com