pip

“what about python pip and node and bun which bundle their own certs?”

“Pip and npm may be insecure, and that is a fault of those tools”

“I wonder if the anti-Rust zealots have actually ever used pip, especially on Windows”

“Importing software/code at runtime from the internet (like Apt, Go, Pacman, Pip, NPM, etc.) is the equivalent of those dreadful online stub installer packages”

“Pip installs everything system wide and you can't have different versions of the same package without venv.”

“it does a package manager job well, it just works”

“pyenv and pip (just pyenv really) are a little clunky, but work too.”

“All the others normalize and encourage importing random unvetted dependencies for the sake of developer convenience.”

“It's for people that don't want to deal with budgets or spreadsheets and need some help with their personal finances.”

“I particularly work on performance and stability and think we've been making big strides over the last two years”

“Most popular GUI stuff is from universe, as are quite a few dev tools.”

“Pip ain't perfect, but it is stable in a sense.”

“and so was pip — in an era where most other scripting languages didn’t have pinning for sub dependencies either”

“if pip works, is easy, and is a python standard, why change?”

“pip install --require-hashes with a locked requirements file catches exactly this”

“use package managers (npm, cargo, pip, etc) outside of a VM you are substantially more vulnerable to attack”

“Pip resolves dependencies just fine. It just also lets you try to build the environment incrementally”

“any project that has UV and any developer that tries to get uv into a project is on average less safe than a project that just uses pip and a requirements.txt”

“pip was fine for many use-cases after they added native lock files”

“i still rely on good ol pip and have had no issues”

“I have never experienced issues with pip”

“pip install is perfectly fine for other use cases”

“For all of the good that pip did it has shortcomings which only a new package manager turned out capable of solving.”

“it's a reasonable complaint that `pip install` has become less useful now that it resists installing tools outside of a venv”

“pip isn't entirely to blame for all of Python's bad package management”

“The Python ecosystem has taken a huge step backwards with the preachy attitude that you have to do everything in a venv.”

“the pip+venv approach works fine with pyproject.toml, which was designed for interoperability”

“recent versions of pip are significantly faster”

“pip doesn't have to be the way it is in order to actually solve the problem of installing Python packages”

“Pip, Maven and Go are not immune either but they do things structurally better to shift the problem.”

“The 2025 pip experience is, believe it or not, much better than the ~2018 pip experience”

“it's flawed but it works for common cases”

“pip install has been a significant percentage of the deploy time on pretty much every app I've ever deployed”

“If you do any npm install, pip install ... it is very easy to get compromise.”

“you can use a global pip with `--python` and create your venvs `--without-pip` to save time”

“Pip unpacks from the wheel each time (which also entails copying the data rather than doing fast filesystem operations”

“Pip just has horrible internal architecture that can't be readily fixed because of all the legacy cruft.”

“It works very well when you're installing a pip managed program.”

“fortunately. It’s a setting you can disable if you want to be able to accidentally trash your environment.”

“pip gets downloaded billions of times annually”