Security : haxelib run.n should be compiled from source by the client about haxelib HOT 4 CLOSED

What exactly is the security issue here? Both running and compiling then
running have access to the same system permissions... So I fail to see the
difference. Can you provide more info?
On 17 May 2013 01:34, "wighawag" [email protected] wrote:

—
Reply to this email directly or view it on GitHubhttps://github.com/back2dos/haxelib/issues/36
.

from haxelib.

Well, one could argue that having the guarantee that the source included is what produces run.n gives you the opportunity to verify that no malicious code is executed on your machine. Then again, I think it's absolutely unrealistic that someone might actually use that opportunity. Technically you could do very, very bad things with a macro, without even including a run.n, because few people check all the code of a lib for malicious intent.

from haxelib.

Technically you could do very, very bad things with a macro,

And that's the reason try.haxe.org still doesn't let you use macros :)

Is this something we want to change then? I personally think it's not worth it, and having a compiled .n has some advantages, if the run.n has more dependencies than the library itself etc.

from haxelib.

BTW security is the reason that there's no code automatically run after installing a library. I think we can close it.

from haxelib.