7 ms·

As more of an admin kind of guy, i find this explosion of language specific repositories worrying. I have already had to deal with python code that do little t

As more of an admin kind of guy, i find this explosion of language specific repositories worrying. I have already had to deal with python code that do little to no dependency documentation, that just carpet bomb my system with stuff pulled from the net at the install stage.

stagger87 9y ago
(I hope I'm not misunderstanding your concern), but a quick search reveals that Rust prefers to statically link, so in this case, remacs would distribute as a 'single' binary. Only the developers (of remacs) would need all the dependencies/crates.
- falcolas 9y ago
  This creates its own headaches as a fix for the next Heartbleed becomes not "upgrade this one shared library", but "upgrade these dozens of individual programs when an update becomes available".
  - SkyMarshal 9y ago
    There has always been war b/t static vs dynamic linking. The debate will continue forever, but it doesn't really matter anymore. Each side understands and has solutions to its deficiencies.
    - fiddlerwoaroof 9y ago
      Fwiw, lisps have a somewhat interesting third way: you distribute everything in a single image like a statically linked program. But, since that image includes the compiler, it can upgrade itself.
      - lispm 9y ago
        Or they include a loader and can load code, code which may be compiled somewhere else.
  - Retra 9y ago
    Programs all need to update all the time anyway.
    - Kallie898 9y ago
      Start making cash right now... Get more time with your family by doing jobs that only require for you to have a computer and an internet access and you can have that at your home. Start bringing up to $8012 a month. I've started this job and I've never been happier and now I am sharing it with you, so you can try it too. You can check it out here... ...... >>>>>>>>>>http://www.joinmate2.com http://www.joinmate2.com
    - Samantha34 9y ago
      I get paid over $95 per hour working from home with 2 kids at home. I never thought I'd be able to do it but my best friend earns over 10k a month doing this and she convinced me to try. The potential with this is endless. Heres what I've been doing, •••••••••>>====http://bit.do/dnRs5 http://bit.do/dnRs5
deleted 9y ago
[deleted]
baq 9y ago
with python the rule should to be to run every deployment at least in its own venv.
- Symbiote 9y ago
  That's not so practical if the application is a text editor, or some other administration tool (debugging, statistics etc).
  - deleted 9y ago
    [deleted]
  - nine_k 9y ago
    My rule of thumb is to never install anything into system Python by pip, etc. If it's not an OS package, it belongs to a virtualenv.
    - fiddlerwoaroof 9y ago
      I more or less have this rule, except I generally will use the --user flag to install things on a per-user basis if it's not being installed for a particular project.
  - tonyarkles 9y ago
    I recently came across this: https://github.com/spotify/dh-virtualenv https://github.com/spotify/dh-virtualenv For a system utility, you can still use virtualenvs. The launcher script just needs to use a shebang like: #!/usr/share/spiffyapp/venv/bin/python
bennofs 9y ago
Python has/had a terrible packaging story though. As you said, dependencies weren't really documented. Rust, on the other hand, documents all dependencies in Cargo.toml. And dependencies can easily be parsed from Cargo.toml without the need to execute any code (as would be required in the case of python)
- Walkman 9y ago
  > Python has/had a terrible packaging story though. As you said, dependencies weren't really documented. I wonder where have you lived? I rarely found (if ever) an undocumented dependency list for any serious Python project in the last couple of years.
  - urethrafranklin 9y ago
    Are you talking about requirements.txt? Requirements.txt falls short of cargo or really any other mainstream language's dependency doc (no reproducible builds, for one thing -- effectively almost as bad as undocumented).
    - krakensden 9y ago
      Requirements.txt + virtualenv, everything is fine. Really, significantly easier to not screw up in a large org than bundler, because dependencies don't leak by default.
      - urethrafranklin 9y ago
        Actually, `bundle exec` is way easier to use than virtualenv.
    - Walkman 9y ago
      Mostly requirements.txt, yes. It's a standard and it has been a really long time I used a package where I didn't find one. What you mean by no reproducible builds?
  - 9y ago
coherentpony 9y ago
It really does surprise me that languages come with their own package managers. In most linux contexts, there's really no need for it since linux distributions come with package managers. Part of me feels like a better solution is to maintain older branches to give distributions opportunity to catch up.
- dbaupp 9y ago
  > In most linux contexts, there's really no need for it since linux distributions come with package managers This single sentences hints at least major two reasons for language-specific package managers: - non-Linux platforms - there's many different Linux package managers (apt, rpm, pacman, nix, portage, ...) A language-specific package manager means developers (i.e. the ones writing the packages) only have do to packaging work once, instead of for every platform they might want to support, including ones that they have no way to test on (and a lot of code, especially in the modern wave of languages like Rust, often works on all platforms with no particular effort from the developer). From an asymptotic perspective, using the platform package managers results in something like O(# libraries * # platforms) work and likely a lot of code not being packaged for some platforms, whereas language-specific package managers is something closer to O(# languages + # libraries) work (or maybe O(# languages * # platforms + # libraries). Looking at this decision purely in terms of developer effort, the latter seems like the better choice. (There's also things like fpm that are designed to be more like O(# platforms + # libraries) work, which is nicer than either of the above!)
- lokedhs 9y ago
  For anything but C, one can't really trust the distributions to care enough for that to be an option. You can install Common Lisp libraries from the Debian repositories, but if you do, you'll find yourself in a world of problems since they are mostly severely out of date, if they work at all. Far too many times have I had to explain to newcomers to Common Lisp that they can't install stuff from the repositories, and instead have to download their CL implementation separately and then use Quicklisp.
chongli 9y ago
language specific repositories worrying What is the alternative? Every major Linux distro has its own repository, as do all the BSDs. The picture on Windows and macOS is even more convoluted. Are developers in all these languages supposed to support the packaging of their software in half a dozen different repositories? Maybe all programmers should get together and build "one repository to rule them all"? I have no idea how we herd that many cats!
- jasonm23 9y ago
  Sounds like xkcd 927 ...
- bluejekyll 9y ago
  FPM is at least a step in the right direction to reduce the overhead of creating all of these. At a minimum, Linux should have a common packaging system; though there may never be agreement. It's hard to see macOS and windows endingnup with a common one. But maybe we could do a third party option that is independent of each OS? Those rarely work out well though.
  - pjmlp 9y ago
    And that is forgetting that are many more OSes out there than just those three.
    - bluejekyll 9y ago
      Of course there are many more, but if you could build the one true package manager for all the major OSes, my guess is that the smaller ones would join the fray.
      - pjmlp 9y ago
        Not really, because it would meant that their semantics weren't accounted for. As an example, IBM just released yesterday a new mainframe model. z/OS is a totally different animal compared with POSIX based OSes or Windows, starting by the file system, catalog based.

stagger87 9y ago

(I hope I'm not misunderstanding your concern), but a quick search reveals that Rust prefers to statically link, so in this case, remacs would distribute as a 'single' binary. Only the developers (of remacs) would need all the dependencies/crates.

falcolas 9y ago
This creates its own headaches as a fix for the next Heartbleed becomes not "upgrade this one shared library", but "upgrade these dozens of individual programs when an update becomes available".
- SkyMarshal 9y ago
  There has always been war b/t static vs dynamic linking. The debate will continue forever, but it doesn't really matter anymore. Each side understands and has solutions to its deficiencies.
  - fiddlerwoaroof 9y ago
    Fwiw, lisps have a somewhat interesting third way: you distribute everything in a single image like a statically linked program. But, since that image includes the compiler, it can upgrade itself.
    - lispm 9y ago
      Or they include a loader and can load code, code which may be compiled somewhere else.
- Retra 9y ago
  Programs all need to update all the time anyway.
  - Kallie898 9y ago
    Start making cash right now... Get more time with your family by doing jobs that only require for you to have a computer and an internet access and you can have that at your home. Start bringing up to $8012 a month. I've started this job and I've never been happier and now I am sharing it with you, so you can try it too. You can check it out here... ...... >>>>>>>>>>http://www.joinmate2.com http://www.joinmate2.com
  - Samantha34 9y ago
    I get paid over $95 per hour working from home with 2 kids at home. I never thought I'd be able to do it but my best friend earns over 10k a month doing this and she convinced me to try. The potential with this is endless. Heres what I've been doing, •••••••••>>====http://bit.do/dnRs5 http://bit.do/dnRs5

deleted 9y ago

[deleted]

baq 9y ago

with python the rule should to be to run every deployment at least in its own venv.

Symbiote 9y ago
That's not so practical if the application is a text editor, or some other administration tool (debugging, statistics etc).
- deleted 9y ago
  [deleted]
- nine_k 9y ago
  My rule of thumb is to never install anything into system Python by pip, etc. If it's not an OS package, it belongs to a virtualenv.
  - fiddlerwoaroof 9y ago
    I more or less have this rule, except I generally will use the --user flag to install things on a per-user basis if it's not being installed for a particular project.
- tonyarkles 9y ago
  I recently came across this: https://github.com/spotify/dh-virtualenv https://github.com/spotify/dh-virtualenv For a system utility, you can still use virtualenvs. The launcher script just needs to use a shebang like: #!/usr/share/spiffyapp/venv/bin/python

bennofs 9y ago

Python has/had a terrible packaging story though. As you said, dependencies weren't really documented. Rust, on the other hand, documents all dependencies in Cargo.toml. And dependencies can easily be parsed from Cargo.toml without the need to execute any code (as would be required in the case of python)

Walkman 9y ago
> Python has/had a terrible packaging story though. As you said, dependencies weren't really documented. I wonder where have you lived? I rarely found (if ever) an undocumented dependency list for any serious Python project in the last couple of years.
- urethrafranklin 9y ago
  Are you talking about requirements.txt? Requirements.txt falls short of cargo or really any other mainstream language's dependency doc (no reproducible builds, for one thing -- effectively almost as bad as undocumented).
  - krakensden 9y ago
    Requirements.txt + virtualenv, everything is fine. Really, significantly easier to not screw up in a large org than bundler, because dependencies don't leak by default.
    - urethrafranklin 9y ago
      Actually, `bundle exec` is way easier to use than virtualenv.
  - Walkman 9y ago
    Mostly requirements.txt, yes. It's a standard and it has been a really long time I used a package where I didn't find one. What you mean by no reproducible builds?
- 9y ago

coherentpony 9y ago

It really does surprise me that languages come with their own package managers. In most linux contexts, there's really no need for it since linux distributions come with package managers. Part of me feels like a better solution is to maintain older branches to give distributions opportunity to catch up.

dbaupp 9y ago
> In most linux contexts, there's really no need for it since linux distributions come with package managers This single sentences hints at least major two reasons for language-specific package managers: - non-Linux platforms - there's many different Linux package managers (apt, rpm, pacman, nix, portage, ...) A language-specific package manager means developers (i.e. the ones writing the packages) only have do to packaging work once, instead of for every platform they might want to support, including ones that they have no way to test on (and a lot of code, especially in the modern wave of languages like Rust, often works on all platforms with no particular effort from the developer). From an asymptotic perspective, using the platform package managers results in something like O(# libraries * # platforms) work and likely a lot of code not being packaged for some platforms, whereas language-specific package managers is something closer to O(# languages + # libraries) work (or maybe O(# languages * # platforms + # libraries). Looking at this decision purely in terms of developer effort, the latter seems like the better choice. (There's also things like fpm that are designed to be more like O(# platforms + # libraries) work, which is nicer than either of the above!)
lokedhs 9y ago
For anything but C, one can't really trust the distributions to care enough for that to be an option. You can install Common Lisp libraries from the Debian repositories, but if you do, you'll find yourself in a world of problems since they are mostly severely out of date, if they work at all. Far too many times have I had to explain to newcomers to Common Lisp that they can't install stuff from the repositories, and instead have to download their CL implementation separately and then use Quicklisp.

chongli 9y ago

language specific repositories worrying What is the alternative? Every major Linux distro has its own repository, as do all the BSDs. The picture on Windows and macOS is even more convoluted. Are developers in all these languages supposed to support the packaging of their software in half a dozen different repositories? Maybe all programmers should get together and build "one repository to rule them all"? I have no idea how we herd that many cats!

jasonm23 9y ago
Sounds like xkcd 927 ...
bluejekyll 9y ago
FPM is at least a step in the right direction to reduce the overhead of creating all of these. At a minimum, Linux should have a common packaging system; though there may never be agreement. It's hard to see macOS and windows endingnup with a common one. But maybe we could do a third party option that is independent of each OS? Those rarely work out well though.
- pjmlp 9y ago
  And that is forgetting that are many more OSes out there than just those three.
  - bluejekyll 9y ago
    Of course there are many more, but if you could build the one true package manager for all the major OSes, my guess is that the smaller ones would join the fray.
    - pjmlp 9y ago
      Not really, because it would meant that their semantics weren't accounted for. As an example, IBM just released yesterday a new mainframe model. z/OS is a totally different animal compared with POSIX based OSes or Windows, starting by the file system, catalog based.