HaxeFoundation
Post install hooks
This one goes mostly to @ncannasse who has opposed this up until now.
I'm not really against, because with macros, malicious code can be executed with simply by calling -lib evillib (which has --macro evellib.CitadelOfDoom.worldDomination()).
The one issue I see is that there are situations where users need to run haxelib with sudo, in which case a post install hook would have more permissions. But generally you shouldn't sudo if you don't know what you're doing.
NPM is a significantly bigger ecosystem and they don't seem to run into problems with this. Unless there is serious opposition on this, I'd like to add it. If need be, we can still ask for confirmation and the brave ones can just skip that with --always. Thoughts?
To quote Hugh from haxedev:
With the advent of macros, I thought we might be past caring about malicious code, since compiling with a lib can now do pretty much whatever it likes, so the post-install seems like a good idea. (eg, haxelib dev haxelib_client my_malicious_path, effectively rootkitting you next time you do "su").
Why not but then let's make sure that it's at least written in Haxe by running it with haxe --run, so our wanabee world dominators will have to learn Haxe first, so we win.
Is this only for post-install hook or is there plans for a pre/post-update and pre-remove too?
