Decide on an official policy for sudo pip install ...

[nejucomo]

The comments in #425 have veered off topic to a discussion about whether or not pip should attempt to detect sudo pip install ... usage and warn about it; or whether documentation should recommend against that usage, or the like.

At the very least, there should be a consensus about this, and the discussion should be pulled out of #425 into this or other more specific tickets. When tickets have a narrow, well defined scope, they are more likely to be closable / closed satisfactually.

[dstufft]

Personally I use sudo pip .. and I'd be against anything that attempts to detect if you're running it. That being said I do think it should be documented as advanced usage with warnings that state you may mess up your system. I have some plans to make pip and OSs play nicer with each other but that's down the road a bit.

[westurner]

That being said I do think it should be documented as advanced usage with warnings that state you may mess up your system.

Is this similar to zopefoundation/zodbpickle#2 ?

• CWE 829: Inclusion of Functionality from Untrusted Control Sphere
• CWE 913: Improper Control of Dynamically-Managed Code Resources

[dstufft]

Closing this. We're going to be switching to --user as a default (#1668) which is about as official as a policy as I feel comfortable expressing in pip. There are use cases for sudo and it's up to individual users to decide when and where to use it.