<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On Oct 27, 2009, at 7:41 PM, David Lyon wrote:</div><blockquote type="cite"><div><font class="Apple-style-span" color="#000000"><br></font></div><div>I'm not sure about that Tarek..<br><br>An .exe installer as a perfect binary format for python packages?<br><br>Are you serious?<br><br>That is the biggest security threat I can think of, asking python<br>users to run unverified, unsigned, un-trusted executable files on<br>their systems.<br></div></blockquote></div><br><div>easy_install, pip, and indeed all of PyPI is basically a system for executing untrusted code, usually as a system administrator, straight off of what is effectively a wiki.</div><div><br></div><div>If you're concerned about security and distutils, there is a _lot_ of work to do. There is no particular additional danger in executing a .exe rather than a setup.py.</div><div><br></div><div><br></div></body></html>