5 ms·

It's evident from reading the OP and previous similar posts on HN that many developers find it difficult to specify and replicate deterministic Python environme

by cs702 6y ago

It's evident from reading the OP and previous similar posts on HN that many developers find it difficult to specify and replicate deterministic Python environments for their applications. Personally, I have found it best to use (a) a virtualenv or conda environment, with (b) a requirements file that specifies fixed version numbers for packages (e.g., `pandas==1.0.3`). Only very rarely have I run into issues doing this; it works quite well for me. -- That said, from a security standpoint, I'm not sure it's a good idea to run a script downloaded from the web, without verification, on your local command line: curl https://pyenv.run | bash If that URL ever gets hijacked, you would be running malicious code. At a minimum, you may want to take a look at the script before running it, or otherwise verify that you're downloading what you actually want to run.

hojijoji 6y ago
Don't you get a bunch of incompatible packages when you restrict to specific fixed version numbers without indication? I guess this is only helpful if you don't plan to reuse your code in another project.
- cs702 6y ago
  Good question. The approach I proposed works for production applications that require an easy-to-replicate, deterministic environment, but I wouldn't recommend it if you're trying to build, say, Python packages or frameworks meant to be used in diverse environments.
tyrion 6y ago
I completely agree. I have no idea why many people seem to be fan of this `curl x | bash` approach. For pyenv all is needed is to clone their git repository and add a couple of lines to your .bashrc.
- BiteCode_dev 6y ago
  Honestly, the best approach should be "sudo apt get pyenv", but it's such a pain to package a program as a deb I undertand many people don't bother. Beside, curl works on all linux AND on mac. Saves time.
- dahfizz 6y ago
  I think `curl | bash` is treated unfairly. Whether you `git clone` or `curl` a script, you are fundamentally doing the same thing: downloading and executing code from the internet. `git clone` just feels safer because it is hiding that fact under layers of abstraction. If I want to run pip, I need to trust PYPA. It's their code I want to run, and I need to download it one way or another. If I don't trust them to keep their domain secure, I don't see why I would trust them to keep their github repo secure. And the whole point of pip is to download code from PYPI and run it. pip, git, curl|bash, all do the same exact thing in this case. curl|bash just smells funny because it makes it more plainly obvious what is going on.
  - dtech 6y ago
    git clone will not execute arbitrary code from the internet without inspection.
    - hagy 6y ago
      I assume the cloned git repo includes arbitrary code that will be executed with the same security profile as a downloaded shell script.
    - dahfizz 6y ago
      If you read the source of all the programs you run, more power to you. Most people don't.
jzzskijj 6y ago
Exactly. The WHOIS information of pyenv.run doesn't reveal anything who is controlling the domain. And the "more information" link https://raw.githubusercontent.com/pyenv/pyenv-installer https://raw.githubusercontent.com/pyenv/pyenv-installer in that script points to "400: Invalid request" result.
thefunnyman 6y ago
Perhaps this is just my own inexperience showing but I haven’t ever had an issue using venv (which is included in python3 now) and a requirements.txt file.

by cs702 6y ago

hojijoji 6y ago

Don't you get a bunch of incompatible packages when you restrict to specific fixed version numbers without indication? I guess this is only helpful if you don't plan to reuse your code in another project.

cs702 6y ago
Good question. The approach I proposed works for production applications that require an easy-to-replicate, deterministic environment, but I wouldn't recommend it if you're trying to build, say, Python packages or frameworks meant to be used in diverse environments.

tyrion 6y ago

I completely agree. I have no idea why many people seem to be fan of this `curl x | bash` approach. For pyenv all is needed is to clone their git repository and add a couple of lines to your .bashrc.

BiteCode_dev 6y ago
Honestly, the best approach should be "sudo apt get pyenv", but it's such a pain to package a program as a deb I undertand many people don't bother. Beside, curl works on all linux AND on mac. Saves time.
dahfizz 6y ago
I think `curl | bash` is treated unfairly. Whether you `git clone` or `curl` a script, you are fundamentally doing the same thing: downloading and executing code from the internet. `git clone` just feels safer because it is hiding that fact under layers of abstraction. If I want to run pip, I need to trust PYPA. It's their code I want to run, and I need to download it one way or another. If I don't trust them to keep their domain secure, I don't see why I would trust them to keep their github repo secure. And the whole point of pip is to download code from PYPI and run it. pip, git, curl|bash, all do the same exact thing in this case. curl|bash just smells funny because it makes it more plainly obvious what is going on.
- dtech 6y ago
  git clone will not execute arbitrary code from the internet without inspection.
  - hagy 6y ago
    I assume the cloned git repo includes arbitrary code that will be executed with the same security profile as a downloaded shell script.
  - dahfizz 6y ago
    If you read the source of all the programs you run, more power to you. Most people don't.

jzzskijj 6y ago

Exactly. The WHOIS information of pyenv.run doesn't reveal anything who is controlling the domain. And the "more information" link https://raw.githubusercontent.com/pyenv/pyenv-installer https://raw.githubusercontent.com/pyenv/pyenv-installer in that script points to "400: Invalid request" result.

thefunnyman 6y ago

Perhaps this is just my own inexperience showing but I haven’t ever had an issue using venv (which is included in python3 now) and a requirements.txt file.