1

What is the most secure way to install Python 3.X on Windows 10? I have Windows 10 version 1809, and there are so many ways to install Python on Windows, such as the regular way (CPython), IronPython, WinPython, Miniconda or Anaconda, etc (for example, see here). Is there a way to install Python that reduces security vulnerabilities such as a virtualized or "sandboxed" installation of Python on Windows, or is this not needed?

closed as unclear what you're asking by forest, Steffen Ullrich, Anders, LvB, AndrolGenhald May 13 at 18:06

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Could you develop what risks you are worried about? What is it that you want to do? E.g. do you want to run untrusted Python scripts? – Anders May 13 at 10:22
0

In general, for most users, there's no need to install Python "virtualized" or "sandboxed." A malicious program would have the same "permission" level (run all the same user level OS assembly instructions) with or without Python installed. Python would only be a vehicle for execution.

Before installing any program, it's always good to verify the integrity of the application either through a posted hash, or ensuring that the code-signing certificate is valid and from the correct publisher (especially when downloading from non-official websites). This would mean a high confidence the application wasn't modified before it got to your computer. For trusted programs like Python, this is much more important than sandboxing.

If you wanted to take this up a notch, you could always install Python on a virtual machine and do all your work on the virtual machine. This would virtually eliminate the possibility of adverse effects on your main machine (though, certain vulnerabilities like spectre and meltdown could still theoretically affect your main machine from your VM).

  • Thanks for the suggestions. Very sensible advice. – J. P. May 13 at 2:16
0

The default Python distribution, from a security point of view, suffers from the problem that no-one is really in charge of its standard repo, so this is a vector for attack. A distribution like Anaconda is curated, so as long as you stay within its ecosystem you are somewhat safer.

The value of virtualenvs in your scenario is that you can download your dependencies, inspect their integrity, then never have to touch the network again while running.

  • Thanks for the info and the suggestion about virtualenvs. I think using virtualenvs is good practice, then I can deactivate it and delete the environment folder contents when it's not needed. – J. P. May 13 at 2:15
  • Your answer is at least misleading. PyPI and the standard Python distribution are different things. You can use the standard Python distrib (AKA CPython) without PyPI and you can use packages from PyPI from any distribution. Anaconda is just an easy way, because it comes with a bunch of supported packages that a beginner does not need to search on PyPI. Its is specifically interesting for a scipy, numpy and pandas usage, but if OP just wants to learn the Python language, CPython is perfectly fine. – Serge Ballesta May 13 at 13:44

Not the answer you're looking for? Browse other questions tagged or ask your own question.