alt Hacker NewsI'd like to see a security breakdown of uv versus pip versus conda versus whatever fashionable package manager I've not heard of yet.
Speed is okay, but security of a package manager is far more important.
Replies
diggan • yesterday at 11:49 AM
> security breakdown of uv versus pip versus conda versus whatever fashionable package manager
In the end, every package manager (so far at least) download and runs untrusted (unless you've verified it manually) 3rd party code. Whatever the security difference is between uv and pip implementation-wise is dwarfed compared to if you haven't found a way of handling untrusted 3rd party code yet.
uv is generally more secure than pip. It resolves dependencies without executing arbitrary code, verifies package hashes by default, and avoids common risks like typosquatting and code execution during install. It's also faster and more reproducible.
https://chaitalks.tech/uv-a-modern-python-package-manager-in...
https://docs.astral.sh/uv/pip/compatibility/