Live data from Hacker News

Python: Please stop screwing over Linux distros

drewdevault.com

231–240 of 384 posts

Re: Python: Please stop screwing over Linux distros

#231
I got introduced to pip and virtualenv when I started coding in python in 2013-14. Except for the system/3rd party python and python2/python3 confusion a couple of times, I've been able to set up many projects at multiple companies that quite a few people have worked on over the years without any problem just using pip and virtualenv. Somehow every time I searched about a better way of doing it, the new tools looked more confusing that the existing one. And since the existing ones keep working very well, I haven't had any incentive to move to any other tool that does even more magic under the wraps, in the name of making things simpler, because when the required conditions aren't met, these tools simply tend to give up. So I just setup the virtualenv with the appropriate python version and then use pip to install python dependancies. Projects have varied from webservers to computer vision and forecasting. And have not faced any issue till date.

Re: Python: Please stop screwing over Linux distros

#232

Earlier quoted context omitted.

Static binaries are a different story. Go has dependencies as any other modern language and they had a bad story in the past and have a better story today. Sketch for python: Create a ~/.cache/python/packages directory. Manage all dependencies there. Make the python interpreter "package aware" so that required dependencies are read off a file from the current project (e.g. "py.mod") and adjust "system path" according…

> Manage all dependencies there Are you saying "put the different version of every dependency you need in there if you have to"? Because I don't think package managers are ready for that, they usually like to have one version installed per package.

>Because I don't think package managers are ready for that, they usually like to have one version installed per package.

That's on them. Other language package managers can do it...

Re: Python: Please stop screwing over Linux distros

#233

Distro maintainers say that language ecosystem packaging makes it hard for them. Language ecosystem packaging maintainers say that distro package managers make it hard for them. The year is 2021 and there is no work towards synthesis. It will be endless, fruitless yelling from each side. Maybe 2022 will bring change. I'm not holding my breath. To anyone who finds themselves on a single "side" in this argument: if you…

Question is are the other languages saying the same thing about the distros? Or is this just a python thing

Re: Python: Please stop screwing over Linux distros

#234
post #134

Earlier quoted context omitted.

> Perl is a godsend... take a code from 20 years ago, run it on a modern system, and everything works. That's more or less like "take a VB6 binary from 20 years ago, run it on some modern Windows, and everything works" - that's just because the ecosystem is effectively dead, so supporting it on new releases just means carrying over some stuff that worked 20 years ago.

So, Perl is the new Latin?

It can be:

  use Lingua::Romana::Perligata;
 
  adnota Illud Cribrum Eratothenis
 
  maximum tum val inquementum tum biguttam tum stadium egresso scribe.
  da meo maximo vestibulo perlegementum.
 
  maximum comementum tum novumversum egresso scribe.
  meis listis conscribementa II tum maximum da.
  dum damentum nexto listis decapitamentum fac
      sic
          lista sic hoc tum nextum recidementum cis vannementa listis da.
          dictum sic deinde cis tum biguttam tum stadium tum cum nextum
          comementum tum novumversum scribe egresso.
      cis

Source: https://metacpan.org/dist/Lingua-Romana-Perligata/view/lib/L...

Re: Python: Please stop screwing over Linux distros

#235
post #129

Earlier quoted context omitted.

>Serving the needs of python developers vs. sysadmins is a false dichotomy. Python developers develop on a system that they need to admin. I couldn't disagree more. Even if the same person is admining a system they develop on, they almost certainly aren't going to admin the systems their users deploy on. The admin role and developer role should be completely separate with different goals and requirements. The system…

Interesting; how would you isolate the system python from the user in Debian/Ubuntu. Do you have a link where I could learn more about this?

Don't put the system python in $PATH. Any command that needs the system python can be launched through a shim/wrapper script that sets the PATH. (Or even better to execute python directly to avoid passing the system python in PATH.)

Re: Python: Please stop screwing over Linux distros

#236

Yes, python packaging is a mess. And agreed, there are two separate use cases: development and using the software. But, are distros creating too much work for themselves by trying to package every itty-bitty python library (and for that matter, every npm library)? Are distros doing anything more than scanning CVE databases with the library versions, or are they _actually_ auditing the versions they choose? (Not that…

> Are distros doing anything more than scanning CVE databases with the library versions, or are they _actually_ auditing the versions they choose?

Debian Developer here. Part of packaging work, for Python libraries or anything else, is to verify the reliability of the upstream developers, audit the code, set hardening flags, add sandboxing and so on.

I spotted and reported vulnerability myself and it's not uncommon.

Re: Python: Please stop screwing over Linux distros

#237

Earlier quoted context omitted.

> Disk is plentiful, What makes you think so? SSDs aren't exactly stellar in the cost-per-TB department, as will be the case with each new higher-performance storage technology. Plenty of people cannot afford the prices of new Western tech either, what about them?

> cost-per-TB There you have it: You measure in TB, not gigabytes, not megabytes. Python packages are megabytes.

Not if they pull in all of their dependencies, PyQt would have a complete copy of all Qt binaries and a complete chrome install because of course Qt includes a browser based html viewer. Python packages are gigabytes.

Re: Python: Please stop screwing over Linux distros

#238
post #36

Earlier quoted context omitted.

Users generally don't want Python packages; they want software. They don't care what it's written in, and shouldn't have to install it differently depending on what you chose. “Just learn $language_package_manager_of_the_day, and hope it doesn't break anything when your system changes” is the equivalent of the 90s “./configure ; make ; make install”, and we should have moved past that for end-users by now. Most users…

But our package is for scientific data analysis. It’s a python library. If you’re distributing an application, shouldn’t you just ship an environment with our package bundled?

> If you’re distributing an application, shouldn’t you just ship an environment with our package bundled?

No-no-no-no! If you (application author & distributor) do so, you are obligated to release new version of your application (which includes 3rd party libraries as "environment") each time your dependencies are updated due to security reasons. Do you know many application maintainers who want to do so?

If your application depends on system-installed (distro-provided) libraries (python modules, native libraries, whatever) it is responsibility of distro maintainers do not have versions with known security problems in system-wide repo. It is much better for you (app author & mainitainer) and me (distro user & admin), IMHO.

Re: Python: Please stop screwing over Linux distros

#239
post #39

Earlier quoted context omitted.

Hm, why? I'm a happy user of PYTHONPATH!

It's completely global, shared by all Python interpreters of all versions. I set PYTHONPATH, but the code in that directory is solely small debugging utils of mine that I want available in every Python interpreter, and I make sure not to put anything more complex in there.

"It's completely global"

It doesn't have to be. You can have a launcher for a project that sets PYTHONPATH just when you launch that project.

What is bad practice is to be setting PYTHONPATH in your .bashrc, and for the reason you give - that makes it global across python launches.

Re: Python: Please stop screwing over Linux distros

#240
post #88

Distros, please stop screwing over Python packaging. It is incredible that Debian/Ubuntu pick Python apart and put modules into different packages. They even create a fake venv command that tells you to please install python-venv. What they should just do is offer a bunch of packages like python3.7, python3.8 that install the official python package wholesale into /usr/python or someplace and then symlink one of them…

This is the real legacy problem: Python comes from a world, where only one version of one packaged seemed the right way to do. I do not have a good idea, but other ecosystems evolved much more sane in the realm of packaging. While not ideal, Go has done a fairly good job - and the "module" operations are instant - which they should be.

Go is terrible for distributions to package due to the poor versioning of libraries.
Post reply on HN