As a developer I am used to keep my Python tools updated. Especially packages needed for installing and bundling. Using the most recent releases of pip, virtualenv and setuptools is in my personal experience the most reliable choice.
I have been told recently that from an operations perspective, I should not touch the preinstalled releases of pip on the production machine. So to speak: The typical
pip install -U pip in the virtualenv was a security risk.
There are valid concerns I think, but I do wonder whether this really is the best practice for running services developped with Python. Pip as it is in Debian 7 for example is quite old.
So my questions
- What are the best practices here for running Python services securely?
- Are there ways to move the split worlds (OS Package Tree and Python Package Tree) closer together?