<html><head><style>body{font-family:Helvetica,Arial;font-size:13px}</style></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">On July 2, 2017 at 12:35:34 PM, Vasilis (<a href="mailto:andz@torproject.org">andz@torproject.org</a>) wrote:</div> <div><blockquote type="cite" class="clean_bq" style="font-family: Helvetica, Arial; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;"><span><div></div><div><br>> As Vasilis points out you don’t actually need to install those extra dependencies via pip and are already part of the package installation, however you should NOT install ooniprobe via pip as it’s not the best way to install packages that will run as root.<span class="Apple-converted-space"> </span><br><br>I don't see a problem with installing the ooniprobe package via pip<span class="Apple-converted-space"> </span><br>(running as root). In contrary is a very well tested installation method<span class="Apple-converted-space"> </span><br>that has been tested and used for some time in different systems and<span class="Apple-converted-space"> </span><br>OSes and the default installation method for all lepidopter images.<span class="Apple-converted-space"> </span><br><br>Can you elaborate a bit more why installing ooniprobe from pip is not a<span class="Apple-converted-space"> </span><br>recommended installation method?<span class="Apple-converted-space"> </span></div></span></blockquote></div><p>For a variety of reasons:</p><p>1. Older versions of pip had pretty serious security issues where packages were downloaded in plaintext</p><p>2. Still today if a depedency is not hosted on a https site pip will fail open and download it via plaintext</p><p>3. By installing packages with pip system wide you run the risk (and it’s actually quite likely) that the pip installed packages will overwrite the system installed package leading to an unstable system (this is especially common for Ubuntu where the system relies heavily of python)</p><p>I think 3. is the most important point actually, especially for a users machine.</p><p>What I wanted to add is that pip should only ever be used on users machines to install software in a virtualenvironment. It can and will break you system and once you pollute you system wide installation with packages installed with pip it’s really hard to go back to a clean slate.</p><p>I think for lepidopter it’s kind of OK at the moment, given the fact that it’s single purpose computer where the user may not mind if some other python software on the system breaks.</p><p>~ A.</p><p><br></p></body></html>