Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Python Is Eating the World

zdnet.com

Post reply on HN
Print view View original

941–950 of 993 posts

Re: Python Is Eating the World

#941

Post by erichurkman »

sciyoshi wrote: post #70
astonex wrote: post #42

Earlier quoted context omitted.

>Most people just cross their fingers and hope dependencies don't change Is there anything wrong with pip freeze > requirements.txt and then pip install -r requirements.txt ? This would install the exact versions

I've had a good experience with pip-tools ( https://github.com/jazzband/pip-tools/ ) which takes a requirements.in with loosely-pinned dependencies and writes your requirements.txt with the exact versions including transitive dependencies.

Late to the party but `pip-tools` also has a flag for its `pip-compile` flag: `--generate-hashes`. It generates SHA256 hashes that `pip install` checks.

Re: Python Is Eating the World

#942

Post by linsomniac »

acdha wrote: post #598
memorysafety wrote: post #397

Earlier quoted context omitted.

> curl ... | python Ah goddamnit. 868 lines, including os.rmtree calls and stuff. Also installable via pip, but... "not recommended", and: [RuntimeError] Poetry was not installed with the recommended installer. Cannot update automatically.

It’s running over HTTPS from an auditable source. Is that _really_ so much worse than a pip install, and can you explain in detail why you believe that to be true?

I teach my kids to use the right tool for the job, because using the wrong tool for the job can lead to injuries. But I violate this all the time, myself. It's just a good habit to get into.

"curl | bash" is a bad habit to get into. It works under certain circumstances, like making sure it's an SSL connection from a source you trust. But it's just a bad habit for the average person to get into.

Re: Python Is Eating the World

#943

Post by cercatrova »

mruts wrote: post #549
mkl wrote: post #102

Earlier quoted context omitted.

It seems to value my time quite highly, as I can achieve most things more quickly and easily in Python than any other language I know. Can you be more specific about how it increases your burnout? Is it the language, or someone forcing you to use that linter and settings?

Here’s my long list on why Python is terrible: 1) No pattern matching. In 2019, this is just unacceptable. Pattern matching is so fundamental to good FP style that without it, it becomes almost impossible to write good and clean code. 2) Statement vs expression distinction. There’s no need for this and it just crippled the language. Why can’t I use a conditional inside an assignment? Why can’t I nest conditions insid…

It seems you just want a functional language. If so, why are you using Python, as there are much better alternatives like you mentioned, if not in the data science space? I use Python only for data science and generally Elixir, Racket, Haskell etc for other use cases.

Re: Python Is Eating the World

#944

Post by MiroF »

acdha wrote: post #902
MiroF wrote: post #809

Earlier quoted context omitted.

it's pretty easy to detect only when you are being piped and then only include malicious code then

Do you believe GitHub has that infrastructure deployed? If not, this is a blind alley to worry about. If so, what other precautions have you taken to avoid compromised tarballs, unauthorized pushes to repos with auto-deployment pipelines, etc.? The point is that in reality you’re orders of magnitude more likely to be compromised by ads in your browser, an undetected flaw in legitimate code, or a compromised maintaine…

Fair point - I didn't actually click so I didn't see that it was a Github link, I was just reading the comments.

Re: Python Is Eating the World

#945

Post by vincent-toups »

AnimalMuppet wrote: post #915
vincent-toups wrote: post #825

Earlier quoted context omitted.

That is why we have syntax-case.

Non sequitur? (That is, your comment does not seem to follow whatsoever from mine.)

Suppose there are more things in the programming universe than are strictly represented in (say, R5RS) Scheme. Because Scheme has things like continuations and syntax-transformations, we can put them into the language.

Re: Python Is Eating the World

#946

Post by fellellor »

jhbadger wrote: post #634
fellellor wrote: post #507

Earlier quoted context omitted.

I am trying to find a place in the industry - again, starting from RoR. I absolutely love Ruby. And all this talk of "Ruby dying" makes me feel sad. The rational thing to do is to move on, and learn something popular, like node.js but the more I see Ruby in action, I just can't pull myself away from it. I had managed to get a job as a Java developer a long time ago, but at that time all I could do was barely write to…

Ruby's future may actually not be Ruby itself. Probably the major problem with Ruby is its performance, which is slow even compared to other interpreted languages. While I'm not sure it is really production ready yet, Crystal is very interesting -- it's a native compiled statically typed language that nevertheless feels very much like Ruby. Check it out if you haven't.

I saw Tenderlove's interview on SE Radio, about Ruby internals. He seemed optimistic, but also because he's been working on a performance related project for the past few years now. Anyway, I'm hopeful.

Re: Python Is Eating the World

#947

Post by tekknik »

acdha wrote: post #938
tekknik wrote: post #921

Earlier quoted context omitted.

So because ads can compromise us we should ignore the security of package managers? How about this for a reason, where are the checksums when I’m curling and piping? How do I validate in an automated fashion the validity of this file I’m piping into an interpreter? When installing a package it’s quite easy to have redundant copies of an index with checksums pointing to a repository hosting the actual code. The attack…

HTTPS has checksums, and note that we’re specifically talking about installing from Github, where every change is tracked. > This is bad practice, stop promoting it or downplaying it’s security issues. I’m trying to get you to do some security analysis focused on threats which are possible in this model but not the real alternatives (download and install, install from a registry like PyPI or NPM, etc.). So far we hav…

HTTPS doesn’t know if the file changed on the server so that doesn’t count here.

I am doing security analysis. If this file changes and I’m using it in built server images then I have no way of automatically validating the changes are good without doing the checksumming myself and managing this data. What we have is a server that can be hacked and the files are unable to be verified by checksum

Re: Python Is Eating the World

#948

Post by h1d »

brainless wrote: post #68

Remember NOT to jump into Python for your new product if don't know Python. If you are developing for a young startup, have time crunch, then stick to what you know. IF you do not have a language, or know Python a bit, then pick Python. Here are some of the reasons why I stick to Python (young startup/web APIs): - OOPs is not too strict (might give a headache to some folks) - Mixins, lambda, decorators, comprehension…

That's not how you pick a language. See if the field you're trying to program is well supported and has good libraries and pick that language.

Differences in languages themselves, I'm sure you can get used to and is far easier to cope with than lack of decent lib/tool/googleability.

Re: Python Is Eating the World

#949

Post by winstonewert »

CydeWeys wrote: post #796
cc81 wrote: post #727

Earlier quoted context omitted.

That would not catch the bug if the input is not under is control. You could as well say "Just check if the object is a string" in the method, which would work but the point was rather that it is difficult to notice if you did not think about it. Compared to other languages that would crash or not compile instead.

Yeah, the input isn't really under control because it's coming from deserializing a YAML file. It worked for the exact type of input I was expecting, namely, when you configure a specific value as a list, but it wasn't working for anything else. And YAML has plenty of types it can split out, so my naive fix still only handled lists and strings properly!

Yeah, YAML deserialization is the worst case scenario for dynamic typing. In most situations, types are pretty consistent and assuming you run your code at least once, you'll find most errors. But with YAML deserialization all bets are off. YAML is even worse then JSON for this because seemingly minor changes in the YAML can change the shape of the data.

I've had success validating such data against a schema, so I know it had consistent type structure before working with it.

Re: Python Is Eating the World

#950

Post by odonnellryan »

metroholografix wrote: post #865
odonnellryan wrote: post #803

Earlier quoted context omitted.

Don't get me wrong, it is obviously your right to dislike a language. I've designed plenty of reliable systems in Python without much issues whatsoever with making them reliable. I have had some problems with code organization over the years (Python certainly lets you "do your own thing" which can lead to issues with organization over time) however I haven't had reliability, stability, or speed issues for 95% of the…

How about all of the following: Python GIL takes away lots of viable solutions. Lack of metaprogramming / code generation at runtime. Lack of performance forcing me to severely compromise or implement things in C. Type system is probably among the worst in the dynamic language space (compare to Common Lisp and Erlang). Python is not an interactive programming language and can not be used to implement rapid feedback l…

> Python GIL takes away lots of viable solutions.

Agreed the GIL is annoying, but I've had no issues with creating large distributed job engines with Python. Actually the tooling made it very easy. If you're trying to do this without using existing frameworks I guess it may be difficult.

> Lack of metaprogramming / code generation at runtime.

IMO Python is the definition of metaprogramming. Actually, usually you use something that is literally called a "metaclass" to do so. Also everything is an object that you can override as you like, so not sure what you mean here. Maybe you were not aware of these features and functionality?

> Python is not an interactive programming language

That just isn't true...

Are you using libraries at all or are you avoiding them?

I've met a lot of developers who do not like to use libraries, but that is a major strength of the Python ecosystem.

Post reply on HN