Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Use `Python -m Pip`

snarky.ca

Post reply on HN
Print view View original

111–120 of 141 posts

Re: Use `Python -m Pip`

#111

Post by dmurray »

figbert wrote: post #38

If I'm understanding correctly, this basically just kicks the ball a little further down the road... You shouldn't use pip directly because you don't know which version is the one in your path. Ok: the same applies to the python command? Calling pip is version ambiguous, but so is calling python.

If there's an executable file named "python" in your current directory, typing "python" in your shell won't in general execute that file. You need to add the current directory to your PATH, or to run it explicitly with something like "./python". This is different from the behavior with "python -m modulename".

So this security concern applies when you trust your shell and all the directories in your PATH, but you don't trust the contents of the current directory. That's not the norm, but it's quite a common situation to be in - you downloaded some files but don't intend to execute them.

This is (used to be at least) different on Windows: typing "python" risks executing a file in the current directory called "python.exe", though maybe UAC saves you now.

Re: Use `Python -m Pip`

#112

Post by jcelerier »

jwilk wrote: post #17

Beware that "python -m" is insecure in untrusted cwd: https://bugs.python.org/issue33053 E.g.: $ echo 'import os; os.execvp("cowsay", ["-", "pwned"])' > pip.py $ python -m pip --version _______ ------- \ ^__^ \ (oo)\_______ (__)\ )\/\ ||----w | || ||

> untrusted cwd

... when does that happen and why would you run any program in that case ?

Re: Use `Python -m Pip`

#113

Post by imgabe »

bxparks wrote: post #29

What is the best way for an author of a Python package to develop and test on multiple versions of Python (e.g. 3.6, 3.7, 3.8, 3.9, 3.10), and be able to switch easily among the various Python versions? Every time I try to research this, I get lost in the chaos of Python packaging and environments. Currently I do a `pip3 install -e .`, which uses the default Python provided by the OS. Then I hope that my continuous i…

A lot of people will recommend pyenv, but I find this ends up causing obscure problems as it messes with your PYTHONPATH.

I like to just install alternative versions from source. Download the tarball you want from python.org and run

    ./configure
    make
    make altinstall
and it will be installed separately without overwriting any other version. Then you can just create a venv to use with that version like

    python3.6 -m venv py36

Re: Use `Python -m Pip`

#114

Post by aahortwwy »

jcelerier wrote: post #112
jwilk wrote: post #17

Beware that "python -m" is insecure in untrusted cwd: https://bugs.python.org/issue33053 E.g.: $ echo 'import os; os.execvp("cowsay", ["-", "pwned"])' > pip.py $ python -m pip --version _______ ------- \ ^__^ \ (oo)\_______ (__)\ )\/\ ||----w | || ||

> untrusted cwd ... when does that happen and why would you run any program in that case ?

Maybe you just downloaded a bunch of files into your cwd and now you're going to run a script to process them.

Re: Use `Python -m Pip`

#115

Post by martopix »

ssalka wrote: post #31

Python as a language is a joy to use (for small projects), however pip has soured my experience of Python so drastically that I actively avoid taking up Python projects out of knowledge - not fear, knowledge - that the setup/install process is going to be a humongous pain. In most cases I can get started more easily with Node.js/TypeScript. in b4 "use some other package manager / pipenv / virtualenv etc" - no. How ab…

pipenv and virtualenv are not "some other package manager". The package manager is still pip, which, by the way, does its job as a package manager fairly well. The problem is when you want multiple environments for multiple projects. A problem that is just nonexistent with, say, apt-get, because you don't need multiple environments.

Re: Use `Python -m Pip`

#116

Post by martopix »

My two cents: if you have to use `python -m pip` because it might be the wrong pip or something like that, if you have multiple versions of python and you don't know which one you're using, it means you have a mess in your system, and you're probably going to cry sooner or later regardless of whether you use `python -m`. If there is confusion, `which pip` can help.

As for upgrading pip in Windows, that's a silly argument. When I want to upgrade pip, I will use `python -m`, no need to use it all the time.

Yes, it's a pain to keep your Pythons in order. We can use pyenv and the like. I wish there was a better way and it's unfortunate, but at the moment it's what it is, and having to use `python -m` is only a sign that you don't have control over your own system.

Re: Use `Python -m Pip`

#117

Post by martopix »

nl wrote: post #50
bxparks wrote: post #29

What is the best way for an author of a Python package to develop and test on multiple versions of Python (e.g. 3.6, 3.7, 3.8, 3.9, 3.10), and be able to switch easily among the various Python versions? Every time I try to research this, I get lost in the chaos of Python packaging and environments. Currently I do a `pip3 install -e .`, which uses the default Python provided by the OS. Then I hope that my continuous i…

If you scroll down in the linked article it says: > ALWAYS use an environment! Don't install into your global interpreter! ... > When you need to create an environment for a project I personally always reach for venv and virtual environments. It's included in Python's stdlib so it's always available via python -m venv (as long as you are not on Debian/Ubuntu, otherwise you may have to install the python3-venv apt pac…

Environments don't help you if you want to use different versions of Python.

Re: Use `Python -m Pip`

#118

Post by martopix »

kbumsik wrote: post #42

AFAIR I needed to do that when upgrading pip itself on Windows. `pip install --upgrade pip` may trigger error on Windows because the binary cannot be updated itself. `python -m pip install --upgrade pip` works instead.

The article says that.

Re: Use `Python -m Pip`

#119

Post by xdennis »

xdfgh1112 wrote: post #37
bloblaw wrote: post #18

Earlier quoted context omitted.

I remember when Perl was more popular generally than Python (late 90's and early 00's), and Perl espoused the mantra of (There is more than one way to do it: TIMTOWTDI). As a tongue-in-cheek reaction, Python espoused "TOOWTDI", or There's Only One Way To Do It :) reference: https://wiki.python.org/moin/TOOWTDI The problem is, when it comes to the Python package management ecosystem, there are SO MANY ways to do it. A…

I'm relatively new to python. I use venv, pip and requirements.txt. It's dead simple. What am I missing?

> I'm relatively new to python. I use venv, pip and requirements.txt. It's dead simple. What am I missing?

Compare this with Node. It always installs locally by default and always installs in node_modules regardless of which package manager you use. This is integrated into Node so you never need to modify the path like in Python. You don't have to guess whether your packages are installed in .venv, env, environ, or whatever someone else decides.

`pip` actually has a lot of issues with regards to deciding which version to use. That's why people moved to pipenv... then pipenv stagnated and people moved to poetry.

Using `requirements.txt` is dead simple but it ignores issues such as version locking. If you just add the packages you need to `requirements.txt`, then every time you install you could get a different set of packages. If you do `pip freeze > requirements.txt` then you don't know what comes from what.

Re: Use `Python -m Pip`

#120

Post by 0x008 »

kstrauser wrote: post #28
cmcconomy wrote: post #16

I wish there was a way to lock the global python so you couldn't install packages to it by accident

I have: $ cat ~/.pip/pip.conf [global] require-virtualenv = true ...which makes pip refuse to install anything unless I'm in an activated virtualenv. That, plus running as a regular user that doesn't have write permission to /usr, goes a long way.

then you cannot upgrade pip :D
Post reply on HN