Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Python's batteries are leaking”

pyfound.blogspot.com

Post reply on HN
Print view View original

411–420 of 420 posts

Re: “Python's batteries are leaking”

#411

Post by rmtech »

pornel wrote: post #393
rmtech wrote: post #368

Earlier quoted context omitted.

I've never coded Rust - is there any distinction between a really important crate used by millions of people and something really obscure with 3 users? Are all the crates subject to security audit?

There is no technical distinction. The community is working on a WoT/review tool (cargo-crev), but in the meantime you can see who has published the crate and who uses it. The de-facto standard crates are maintained by Rust team members or well-known authors.

ok. So it's kind of informal at the moment.

Maybe in the future we'll see more hacking of libraries (people managing to deliberately sneak exploits in) and in response stronger lockdowns on important library code.

Re: “Python's batteries are leaking”

#412

Post by gcb0 »

majewsky wrote: post #76
gcb0 wrote: post #68

Earlier quoted context omitted.

And perl solved that perfectly: just let the OS/distro solve the 100s of packages. And it have been solved, despite you claiming otherwise on your last paragraph. When did you have to use cpan in a modern system? Compare that to how many times you had to use pip. Now, if you use a crappy OS or distro (or god forbid, some container built by you have no idea who on top of nobody knows what) then yeah, you are bound to…

> When did you have to use cpan in a modern system? Compare that to how many times you had to use pip. Well yeah. A sizable amount of new software is still being written in Python. But when I use Perl software (besides my custom scripts), it's always stuff that's old enough that the distribution is carrying packages for it. If you disagree, please name a significant new software written in Perl that was released in t…

name one package you missed in those 5 years.

I see your comment as the goal, not the problem.

Re: “Python's batteries are leaking”

#413

Post by gcb0 »

thaumasiotes wrote: post #93
gcb0 wrote: post #68

Earlier quoted context omitted.

And perl solved that perfectly: just let the OS/distro solve the 100s of packages. And it have been solved, despite you claiming otherwise on your last paragraph. When did you have to use cpan in a modern system? Compare that to how many times you had to use pip. Now, if you use a crappy OS or distro (or god forbid, some container built by you have no idea who on top of nobody knows what) then yeah, you are bound to…

> if you must have a system that parses XML but for company policy is not allowed to have even the means of performing a network request. With python you either have both xml and an http library and whatever else included and you will either have to do a special package with a striped down python+xml only or get a corporate exception. While on other languages you can install only the xml parser component package and…

most companies i've worked for have special packages for perl/python/php/etc that compile the interpreter without support for system calls, for example.

That alone have probably paid of handsomely over the years considering all the XSS we patched, which could very well have been full network compromises.

Re: “Python's batteries are leaking”

#414

Post by garettmd »

HelloNurse wrote: post #392
hn_throwaway_99 wrote: post #211

Earlier quoted context omitted.

> If I fight the battle to get centralized IT to install Python, I now have a guaranteed set of standard libraries as well. I'm never going to get permission to install anything other than default. Ever. Can you explain this more? What kind of place do you work? I've had some experience with large, bureaucratic companies, but nothing ever so far as "you can't install any other libraries."

If you must work with one hand tied behind your back you are fucked, and your company is even more fucked. Your priority should be supporting your managers who want to get things done in the struggle against centralized IT managers who want to repress aspirations to work. I'm afraid the standard library has to be aligned with the needs of more normal users who, as already discussed, want to allow libraries to have th…

> the needs of more normal users

I'm afraid users dealing with that sort of bureaucracy are much more normal than you think, if not the norm. They're just usually not the types of folks that are hanging around HN, or they're at least less vocal.

Re: “Python's batteries are leaking”

#415

Post by lugg »

sebazzz wrote: post #344
postgeographic wrote: post #314

Earlier quoted context omitted.

Not who you asked, but I work for a large international company, a big 4 professional services firm. I wanted to install anaconda and Jupyter on my machine (data science is not a part of my 'official' job description, but I wanted to see how much of my data exploration workflow I could speed up or automate). I had to go up three separate hierarchy ladders to get sign off. First, my own team, then IT, then our risk an…

I also work at a big 4, and perhaps the same one as you, and I assure you, there is a way. There is always a procedure or some way you can follow. You just need to know how to look it up. We have our own development team, our own servers, our own freedom to deliver to clients fast without the hassle of the main corporation. How? We talked to the right persons.

Big 4?

Re: “Python's batteries are leaking”

#416

Post by javagram »

lugg wrote: post #415
sebazzz wrote: post #344

Earlier quoted context omitted.

I also work at a big 4, and perhaps the same one as you, and I assure you, there is a way. There is always a procedure or some way you can follow. You just need to know how to look it up. We have our own development team, our own servers, our own freedom to deliver to clients fast without the hassle of the main corporation. How? We talked to the right persons.

Big 4?

https://en.m.wikipedia.org/wiki/Big_Four_accounting_firms

Re: “Python's batteries are leaking”

#417

Post by orf »

jancsika wrote: post #210
j88439h84 wrote: post #193

Earlier quoted context omitted.

Pypi still has a download counter, but it will tend to reflect which libraries are used in ci, so it's a biased estimate.

If only there were a way to filter machines on the internet by some kind of id number, and to subtract numbers from other numbers at scale.

And what about caches and proxies?

Re: “Python's batteries are leaking”

#418

Post by Myrmornis »

postgeographic wrote: post #314
hn_throwaway_99 wrote: post #211

Earlier quoted context omitted.

> If I fight the battle to get centralized IT to install Python, I now have a guaranteed set of standard libraries as well. I'm never going to get permission to install anything other than default. Ever. Can you explain this more? What kind of place do you work? I've had some experience with large, bureaucratic companies, but nothing ever so far as "you can't install any other libraries."

Not who you asked, but I work for a large international company, a big 4 professional services firm. I wanted to install anaconda and Jupyter on my machine (data science is not a part of my 'official' job description, but I wanted to see how much of my data exploration workflow I could speed up or automate). I had to go up three separate hierarchy ladders to get sign off. First, my own team, then IT, then our risk an…

I don't think your company deserves you.

Re: “Python's batteries are leaking”

#419

Post by lukka5 »

stochastastic wrote: post #108

The Python standard library has been a huge help for me. Evaluating which third party packages to trust and handling updates is a hassle. (Would love a solution for this. Does anyone have a curated version of PyPI?) I’m surprised that people want to slim it down other than for performance on a more constrained system. As an aside, why doesn’t the Python standard library extend/replace features with code from successf…

> Does anyone have a curated version of PyPI?

https://python.libhunt.com/ Not exactly curation but it does have rated libs for lots of categories.

Re: “Python's batteries are leaking”

#420

Post by DannyBee »

zzzeek wrote: post #236
DannyBee wrote: post #86

Earlier quoted context omitted.

My only experiences with Guido when he was a Googler were incredibly unpleasant. (This was years ago, and i don't have the email exchange anymore, so i'm doing my best to describe it from memory) I reported a bug I had debugged pretty heavily and believed was likely a bug in the appengine datastore (this was before it was publicly available, IIRC), with a fairly detailed repro recipe, etc. (I was not on the appengine…

Whether you gave him the most succinct demonstration up front or not, it doesn't excuse Guido's behavior and dismissiveness towards you at all . Guido should have found a way to be patient with you and ask for additional information if he felt he didn't have a clear enough explanation, and should have taken the time to prove his hunch (which turned out to be wrong) that the problem was on your end. I did observe that…

I don't disagree with your assessment at all. There is never a reason to act like that and i didn't take it as "the normal course of business".

FWIW: the detailed repro recipe was hermetic and single-binary (and guaranteed to work on his machine for various reasons), it just had more code than strictly necessary (It was still The actual recipe was closer to "run this binary, click on new record button, click save, observe results in datastore".

I actually reduced it not because the recipe was too detailed, but to remove the argument that it was my code.

Post reply on HN