Re: [Tails-dev] Pip is not torified by default

Borrar esta mensaxe

Responder a esta mensaxe
Autor: Hefee
Data:  
Para: The Tails public development discussion list
Asunto: Re: [Tails-dev] Pip is not torified by default
Hey,

> There are many open-source intelligence (OSINT) tools that you can
> install with pip.
>
> > Derya
> >
> > The Privacy Advocate
>
> There also may be different privacy tools that you can install with pip
> that are not in apt or included with tails.
> A guide could be added to advanced topics for these use cases
> https://tails.net/doc/advanced_topics/python_packages


Keep in mind, that installing software via pip is downloading random stuff from
the internet - there is no way of signature, with that you could check, that
you are downloading the thing you wanted to download.

I would highly recommend from a security point of view:Find already in Debian
packaged software or download the source code and build the python packages
from the source. That at least makes sure, that we can look into the code,
what it does.

With Tails 6.0 based on bookworm Python will shout loudly if you try to
install anything via pip, if you don't use a venv, as you may break the
system.

But those are "just warnings" why this is a topic for advanced users and
should not recommended to everyone.

Feel free to create a merge request for this at that gitlab:

https://gitlab.tails.boum.org/tails

All the website you find under wiki/src.

the file you thought of means you need to create that file

wiki/src/doc/advanced_topics/python_packages.mdwn

Regards,

hefee