Live data from Hacker News

Ask HN: Why does every package+module system become a Rube Goldberg machine?

news.ycombinator.com

51–60 of 222 posts

Re: Ask HN: Why does every package+module system become a Rube Goldberg machine?

#51
post #33
post #28

Earlier quoted context omitted.

> There's no reason why a package-management system needs to be language-specific; dependencies are often cross-language. Hell, even some blocks of code contain more than one language. This sounds a lot like a case of https://xkcd.com/927/ . Languages have different ways of importing and installing dependencies, trying to create a package manager over all of those is just going to end up making things even more compl…

> Languages have different ways of importing and installing dependencies They're not actually different. They call things differently, and they have different methods of passing the required lookup paths/artifacts/sources to their compilers/interpreters/linkers, but in the end all of them are conceptually the same thing.

>but in the end all of them are conceptually the same thing

The concept of a programming language isn't what people use, but the concrete reality of specific implementations on specific hardware.

You could also say that a coffee cup and a donut aren't actually different because they're topologically the same... but the facts on the ground do actually matter.

Re: Ask HN: Why does every package+module system become a Rube Goldberg machine?

#52
post #5

At least in Python's case, I think people are much too hard on the packaging system. I don't think anyone has significant issues with pip itself as opposed to the runtime it exists within. Following from this, I think that most back-end applications should try solve their messy runtime environment issues with some containerization. Java/C(++) however...

I find myself in nightmarish scenarios with Python dependencies more often than I'd like to. This dependency is missing this wheel which is missing this bit of C tooling which needs system-level permissions to be installed through XCode on Mac (what?). I've somehow corrupted the package lock, now I'm looking at diffs and checking dependencies of dependencies, inspecting the virtual environment folder and questioning my life choices. PyCharm has somehow lost the sense of where the virtual environment is located, I now have a squiggly line and warning explosion in my IDE.

You could argue many of these are not Python's fault, some can probably be attributed to carelessness on third-party and tooling devs or on my part. But let's invent a metric here: "% of time spent dependency troubleshooting over total programming time". I've had better experiences with this in other languages, and intuition tells me that my carelessness or that of third-party devs being equal, there is something not quite right about the Python dependency management story. I put up with it because like many others I think that the language is otherwise dope.

Re: Ask HN: Why does every package+module system become a Rube Goldberg machine?

#53
They all followed the same process:

Step 1: look at all the existing package+module systems, and realise they are all horrible Rube Goldberg machines, way too bloated for the simple thing you want to do

Step 2: write your own package+module system! It's lean, mean and just does the simple obvious thing your simple one-man project needs.

Step 3: your system hits the real world! Your system is used with projects that involve more than one person and grow organically, and that spread to more and more esoteric environments. The Rube Goldberg projects have Rube Goldberg aims and their target ecosystems have Rube Goldberg requirements while goalposts shift continuously with tight deadlines. You add features and toggles to your system to support these things.

Step 4: congratulations! You are the proud inventor and owner of yet another Rube Goldberg machine. It is now time to move on to better things; the system, meanwhile, is handed over to some committee and will only grow in complexity from here.

https://www.kiplingsociety.co.uk/poem/poems_palace.htm

Re: Ask HN: Why does every package+module system become a Rube Goldberg machine?

#55
post #36
post #8

We have such a theory, it's called "modules". But unfortunately, modules are even less popular than proper typesystems have been for decades. It's no coincidence that Rust (which has basically copied Haskell's type system to a large degree) and Julia (which is essentially a Lisp in disguise) have somewhat sound packaging systems. C/C++ does not even have a tidy core language, let alone proper modules (yes, yes, C++ m…

I do not understand what you mean by modules, and how Rust and not Java or Python is helped by this.

Modules typically refers to a unit of code that packages together several types and functions (and/or other top-level concepts in your language, e.g. macros, templates, metaclasses, namespaces, packages) with an explicitly declared public interface, while still allowing these types and functions to have additional internal APIs that are not exposed. A module has to declare what other modules it depends on explicitly.

The public interface of a module has to be explicit enough that a compiler for that language only needs the public interface description of that module to compile code that depends on it.

A good example of the most widely used and successful module system is C compiled libraries. The header files represent the public description of a library (or, for dynamic linking, the .so/.dll itself embeds this info as well), and a C compiler only requires these header files to be able to compile dependent code and later link the two. It is also impossible to access non-public members of the library from standard C (without resorting to direct memory access, of course).

Java packages don't have these properties because of two problems: there is no way to indicate dependencies between packages, and there is no standard way to have a bundle that corresponds to a package (since different .jar files can all load classes into the same package). The Java module system was created specifically to address these problems (and is still not fully adopted throughout the ecosystem).

C++ breaks C's module system because of its heavy reliance on templates, which have to be entirely declared in the public API and can't have any internal API of their own; and because the compiler needs to know the total size of a class, including the size of its private members, to compile any code which references objects of that class.

For Python, I'm honestly not sure if Python packages fit this definition of a module or not.

Re: Ask HN: Why does every package+module system become a Rube Goldberg machine?

#56

Earlier quoted context omitted.

Tying package management to GitHub seems convenient in the short term, but will be the baggage of the next generation. I cringe hard when I see projects depending on git repos, without pinning a version or commit.

It's not actually tied to GitHub. If GitHub died tomorrow, they would easily be able to move on and host the packages somewhere else. There's no way to do this without hosting. Also, there is a way to pin a version or commit. Julia for example always stores the exact commit information for all packages in the "Manifest" file. There are also straightforward ways to demand certain versions and package maintainers have…

There will be a mess of dependencies of old projects that depend of projects that have since moved off GitHub, there will be name clashes between GitHub projects and BitBucket projects etc. These ecosystems are very much dependent on GitHub, and if/when anything permanent changes, it will be a mess to move off of it.

Re: Ask HN: Why does every package+module system become a Rube Goldberg machine?

#57
post #5

At least in Python's case, I think people are much too hard on the packaging system. I don't think anyone has significant issues with pip itself as opposed to the runtime it exists within. Following from this, I think that most back-end applications should try solve their messy runtime environment issues with some containerization. Java/C(++) however...

> I don't think anyone has significant issues with pip

and boy would you be wrong. I just tried to install `datasette-scraper` on my system. This didn't work because it would consistently pick up outdated versions of Django and `more-itertools` from the system's Python site-packages directory.

By the way I learned to (1) install an updated version of Python that has the advantage of not being the one that the system uses; (2) do not use `pip` the executable but `python3.9 -m pip`; (3) use `pip` with argument `--target vendor` to install everything in a dedicated project-owned directory; (4) prefix my invocation of the software with `PYTHONPATH=./vendor` to add that to the import path; (5) add a `vendor/sitecustomize.py` file with the lines `import sys; sys.path.pop()` to remove the system's `site-packages` from the path.

That's a local installation of a Python package in five easy steps, no 'virtual-env' or some such! Pip is great! /s

Re: Ask HN: Why does every package+module system become a Rube Goldberg machine?

#58
post #5

At least in Python's case, I think people are much too hard on the packaging system. I don't think anyone has significant issues with pip itself as opposed to the runtime it exists within. Following from this, I think that most back-end applications should try solve their messy runtime environment issues with some containerization. Java/C(++) however...

> I don't think anyone has significant issues with pip itself as opposed to the runtime it exists within. I'm running macOS with Macports, and oh boy. For a long time, the aws and eb CLI tools had different package requirements or whatnot, and you couldn't install both of them simultaneously for whatever reason. Some stuff installs fine with the system Python, some stuff needs Macports for a specific Python version,…

System Python? Root access? Oh. That's a terrible, terrible practice.

First, one never touches the system Python. It's there for OS-managed stuff and to run OS components.

Then, every Python-based tool should be installed in a separate, unprivileged virtualenv, with executables symlinked where you find them appropriate (usually ~/bin or /usr/local/bin).

If you find yourself ever issuing a `sudo pip install`, chances are million to one that you are doing a disservice to to yourself.

Re: Ask HN: Why does every package+module system become a Rube Goldberg machine?

#59
post #31

> In contrast, we apparently have no "package management theory". We have not figured out the primitives required to express dependencies We have a good hunch. The basic theory behind Nix definitely goes in the right direction, and if we look away from all the surface-level nonsense going on in Nix, it's conceptually capable (e.g. [0]) of being a first-class language dependency manager. For this to work at scale we'd…

What's a good source, for someone who has never used nix, to read about its conceptual model and how it is different from contemporary dependency managers?

Re: Ask HN: Why does every package+module system become a Rube Goldberg machine?

#60
post #42
post #24

I think package management is something so important you either have to get it right on the first released version of the language, or never release an official one at all. So if you look at C, there was basically no internet or even HTTP, so if they wanted to fetch + store dependencies from centralized repositories, it would have been difficult and then need to change a lot over the years. Python is the worst to me,…

I was going to disagree that Python's is the worst, but then I thought about it and.. yeah, it's up there. I think there are definitely some other ecosystems with worse package management systems but they're certainly not as mainstream as Python.

Relevant XKCD: https://xkcd.com/1987/

As I've said, I still love it and use it a lot, easy to write, easy to explain and share, easy to run without dependencies and if your code runs the same on different versions of Python, but hard to choose which type of virtualenv you want to use, then pick the right versions of dependencies that work together (if you have big dependencies like in data science for example, and some of them are less maintained than others, which happens because the Python ecosystem is rich but people start projects and move on, happens everywhere but because it's easy to start a project in Python, it's also easy to leave it unmaintained).

I love explaining Python code to non coders!

Post reply on HN