931–940 of 993 posts
Earlier quoted context omitted.
Somewhere, I can hear John Siracusa saying, 'curl piped into a shell? No thanks.'
Yes, funny, but seriously, where's the threat model where you've analyzed the risks of installing code from GitHub over HTTPS and found it to be less secure?
(Poetry have done this, for what it's worth)
Earlier quoted context omitted.
For what use case? for math and tech programming in the 90's I would have gone with Fortran.
Fortran IV? But yeah, Fortran was the goto tool for mathematics, simulations, etc. for the same reason Python often is today: libraries and existing code. I had to convert a simulated annealing algorithm from Fortran to C in the '90s
Why did you convert the algorithm from Fortran to c seems a waste of time to me, unless it was a training exercise.
Earlier quoted context omitted.
> curl ... | python Ah goddamnit. 868 lines, including os.rmtree calls and stuff. Also installable via pip, but... "not recommended", and: [RuntimeError] Poetry was not installed with the recommended installer. Cannot update automatically.
Yeah, I hate this trend. Unfortunately, you can't pip install poetry because it needs to manage packages, so I guess a different way was necessary. Still, OS-specific packages would be nice, I guess they just need volunteers.
Earlier quoted context omitted.
> Dependency hell is everywhere. Excuse me, but as a long time Python user I have to disagree. I started using Rust two years ago and Rust’s dependency managment is easily the best thing I ever saw (keep in mind that I didn’t see everything , so there is a chance there are better things out there). The project-/dependency-manager Cargo ¹ is more “pythonic” than anything Python ever came up with and where others mumbl…
There's a pattern to this. The later the dependency manager was created, the better it is. This is a hard problem space where each new language got to use the lessons learned on the earlier ones. Cargo, though, has a silver bullet. If it can't find a solution to determine a single version for a package, it simply includes more than one version in the object code. That would take a lot of work to duplicate in Python.
- module A uses v1 and uses trait v1.A
- module B uses v2 and uses trait v2.A
- will be reported as "A does not implement trait A"
Earlier quoted context omitted.
Why not take this reasoning one step further and have Hacker news impose an 80 character line wrap limit? If you've ever had to deal with this in an email client, you can quickly see that 80 is undershooting it in the modern era.
Funny. I preferentially read HN on my phone which has probably what looks like around a 80 char limit. It makes it really comfortable to read.
Earlier quoted context omitted.
I've always seen it like this: Not everyone builds reproducible software with Python (or in general) and how you handle dependencies can vary. Python leaves it open how you do it: globally installed packages, local packages, or a mix of both. In the end, it needs to find the import in the PYTHONPATH, so there's no magic involved, and there are multiple robust options to choose from. So instead of bashing Python for n…
> Python leaves it open how you do it Are you saying “There’s more than one way to do it”?
Earlier quoted context omitted.
Do you believe GitHub has that infrastructure deployed? If not, this is a blind alley to worry about. If so, what other precautions have you taken to avoid compromised tarballs, unauthorized pushes to repos with auto-deployment pipelines, etc.? The point is that in reality you’re orders of magnitude more likely to be compromised by ads in your browser, an undetected flaw in legitimate code, or a compromised maintaine…
So because ads can compromise us we should ignore the security of package managers? How about this for a reason, where are the checksums when I’m curling and piping? How do I validate in an automated fashion the validity of this file I’m piping into an interpreter? When installing a package it’s quite easy to have redundant copies of an index with checksums pointing to a repository hosting the actual code. The attack…
> This is bad practice, stop promoting it or downplaying it’s security issues.
I’m trying to get you to do some security analysis focused on threats which are possible in this model but not the real alternatives (download and install, install from a registry like PyPI or NPM, etc.). So far we have “GitHub could choose to destroy their business”, which seems like an acceptable risk and about the same as “NPM could destroy their business”.
The knowledge exists that we shouldn’t be encouraging systems to be built with the patterns/tools commonly advocated in the python world — at what point do we acknowledge that the forces promoting this kind of ecosystem are essentially propaganda-like mind viruses ... so much future suffering that will not be prevented ...
Holy Crap! What a lot of irrational, hyperbolic hate for Python. I think everybody should spend their first couple of years working in Fortran IV on IBM TSO/ISPF. No dependency management because you had to write everything yourself. Or maybe [edit: early 90's] C or C++ development where dependency management meant getting packages off a Usenet archive, uudecoding and compiling them yourself after tweaking the config…
I cut my teeth in FORTRAN IV (on RSX-11M). I lived through the archie days of uuencoded fragments to build my C environment, supplemented by DECUS tapes. Those were good old days. I use Python 3 these days for a lot of stuff. It's pretty good. These are better days. We all have complaints, but on the whole, things are not too bad. I think for the most part that when nothing meets your expectations, it may be that you…