> Every one of these package managers is designed for a reckless world in which programmers chuck packages wholesale into ~/.pip, set up virtualenvs and pin their dependencies to 10 versions and 6 vulnerabilities ago, and ship their computers directly into production in Docker containers which aim to do the minimum amount necessary to make their user’s private data as insecure as possible. Is this any different from…
- python is more active than most alternatives, you have new packages created every day.
- python is massively used outside of the web, unlike JS, ruby or PHP, that are 99% web. You get Python in SIG softwares, data analytics, automation, pen testing, sysadmin, biology, etc. It's a huge graph.
- python is used by the distro themselves to code features of the OS. E.G: you remove Python, there is no yum.
- python has a rich compiled extensions ecosystem, produced from c, c++, fortran, and assembly. It's very complicated to ship them.
- it's much more common to have several Python installed than for other dynamic languages. So isolation matters even more.
So the difference is the sheer size of the problem.