[flagged]
What does the term "scripting language" mean to you?
To me, it means that the person who wrote "scripting language" probably doesn't know what they're talking about.
What's up Python? Epic CPython commit, Django 5 and 2FA for PyPI
31–40 of 123 posts
Re: What's up Python? Epic CPython commit, Django 5 and 2FA for PyPI
#32Earlier quoted context omitted.
Wow I underestimated how good it would be
[flagged]
I guess you didn't realize it's a riff on an existing poem.
https://www.poetryfoundation.org/poems/43171/a-visit-from-st...
Re: What's up Python? Epic CPython commit, Django 5 and 2FA for PyPI
#33[flagged]
Python is like anything in that it rewards experience. If you know about asyncio you can write beautiful, performant code that can deal with networking, files, and other blocking resources without halting the program every time. If you know about processor executor pools -- you can easily execute CPU-intensive operations on different cores even though your main program is single-threaded. If you know a little about databases you can write highly portable and simple queries with SQLite.
You can use Python in the same way that other languages allow you to write performant servers, desktop applications, websites, and even software that runs on phone. But you need to know what the best approaches are. The thing about Python is that its a very old language. It didn't always have things like asyncio which is now arguably the best approach for dealing with concurrency and the modern challenges of blocking I/O. New libraries appear all the time, and the language and tooling continue to evolve. I think older developers who may have only dabbled in Python might have out-dated views about the language because there definitely were times in Python's history where it lagged far behind other languages.
Re: What's up Python? Epic CPython commit, Django 5 and 2FA for PyPI
#34I'm still annoyed that they are deprecating datetime.datetime.utcnow(). I have over 1000 references to that function in my projects folder. I understand the footguns that naive datetimes present to the unwary, and yet I still prefer to work with naive always-UTC datetimes. Alas I will end up doing some kind of crazy find-and-replace (at least in the Python 3 code) to something like `datetime.datetime.now(tz=datetime.UTC).replace(tz=None)`. Then of course I'll have to track down all of the bugs from other people doing `from datetime import datetime` and refactor so I now import the whole module just to get a reference to UTC. Grr.
Re: What's up Python? Epic CPython commit, Django 5 and 2FA for PyPI
#352FA but still no namespaces? Dependency confusion attacks are still trivial on PyPI.
Namespacing does not prevent (or even significantly complicate) dependency confusion, unless we think that there's some difference in confusability between these two errors: requestss and requestss/requests (I think namespacing is a good idea in general, but dependency confusion is mostly a disjoint namespaces problem, not a depth problem. Python could solve the former by doing what Go does and make the source reposi…
It helps in some cases. If I type `npm i @google/cloud-sotrage`, I'm still safe. Same with `@google/gcs` (typo vs. misremembering the name). I just have to get the organization name right.
Re: What's up Python? Epic CPython commit, Django 5 and 2FA for PyPI
#36While I'm not against security and 2FA in general, making PyPI 2FA mandatory ahead of any kind of org support is a major pain for big projects with more than one maintainer. This week I was forced to link my company's pypi account to a personal device to unblock our latest release and now none of the dozen other maintainers I work with can get access. Things will get spicy if someone in my position were to die, leave the company on bad terms, etc and a big project can no longer be managed.
PyPI announced orgs back in April, but it seems they still haven't figured out the details on pricing, etc. No telling when those will roll out, but I sure hope it's soon. I'm cynical, but the sequencing of work here very much feels like somebody at Google (or wherever) wanted to push a big open source security project to advance their personal promo case rather than thinking through the needs of serious project maintainers.
Re: What's up Python? Epic CPython commit, Django 5 and 2FA for PyPI
#37The deprecation of "crypt" could have been handled a bit better, IMHO. It recommends to use "hashlib" instead, which isn't API compatible to crypt, and if you load it on a new enough python... triggers a deprecation warning about "crypt" being deprecated. Oh, and it seems unmaintained.
Did you mean "passlib", the third-party module they link to? The built-in "hashlib" doesn't generate any warnings for me on Python 3.11 and is presumably maintained as part of Python.
Anyway, the PEP mentions that "crypt" is not secure, not thread-safe, not cross-platform and not useful for modifying the system password database... so it sounds like you really shouldn't use it for much of anything. What's your usecase?
Re: What's up Python? Epic CPython commit, Django 5 and 2FA for PyPI
#38I'm still annoyed that they are deprecating datetime.datetime.utcnow(). I have over 1000 references to that function in my projects folder. I understand the footguns that naive datetimes present to the unwary, and yet I still prefer to work with naive always-UTC datetimes. Alas I will end up doing some kind of crazy find-and-replace (at least in the Python 3 code) to something like `datetime.datetime.now(tz=datetime.…
Wouldn't it be easier just to write a utcnow() function of your own in a support module and do a find-and-replace to use that?
Re: What's up Python? Epic CPython commit, Django 5 and 2FA for PyPI
#39If you read nothing else, the commit message adding JIT support is worth your time: https://github.com/python/cpython/pull/113465
To the guy who said the pull was horrible:
IMO, the most important thing about a pull request is to... actually be productive. I've worked with people in the past who would nit-pick my commit messages wanting me to waste hours of my time trying to use arcane Git commands. Any of which might and probably will clobber my work.
If you're doing Git reviews a good use of resources is to look for security problems, performance issues, and general engineering problems with someone's code, etc.
A BAD use of Git reviews is to spend the time making stylistic comments 'I would have written it like this, it looks much better', being overly pedantic about code formatting, or forcing your OCD on someone for their Git history. The reason people hate code reviews is somehow they're always done by this latter group of person.
If you're forcing people to waste time for silly reasons then you can count that they'll eventually leave your silly company. I know I have. I was once about to work at a company but saw that they literally used a committee of people to review every commit message wherein they would force every engineer to rewrite code for reasons that seemed to make astrology seem like a hard science. Consider not doing that.
Re: What's up Python? Epic CPython commit, Django 5 and 2FA for PyPI
#40While I'm not against security and 2FA in general, making PyPI 2FA mandatory ahead of any kind of org support is a major pain for big projects with more than one maintainer. This week I was forced to link my company's pypi account to a personal device to unblock our latest release and now none of the dozen other maintainers I work with can get access. Things will get spicy if someone in my position were to die, leave…
You can have centralized TOTP too, I believe e.g. Vault or 1password can do that?