5 ms·

Well I can think of few. For one, if you are writing a script with external dependencies, it's more work than deno to distribute them. For python, you would ne

Well I can think of few. For one, if you are writing a script with external dependencies, it's more work than deno to distribute them. For python, you would need pip. Can you install any script from arbitrary urls using pip? I am not sure but I don't think you can. You also have to declare your deps for pip to figure out. With deno, it's just deno run -A url to script since dependencies are declared in the code with their respective url or file location.

jfkebwjsbx 6y ago
The whole point of Python is that you don't need external dependencies for "small tasks and scripts". A production "script" requiring downloads of third-party code from external servers is already a red flag, by the way.
- searchableguy 6y ago
  You can setup your own mirrors which don't update without audits. Any competent company would do. And I wasn't implying that production scripts shouldn't be self contained. Just placing my 2 cents on why.
  - jfkebwjsbx 6y ago
    How is maintaining mirrors of third-party code any easier, reliable, secure or maintainable than just running Python? Mind you, your Python runtime has been vetted by the Python Foundation, your upstream vendor and your company; is used by many other companies and does not require any network connections to run.
- candu 6y ago
  One could extend that logic to argue that all package managers are red flags: after all, you're downloading third-party code from external servers; you just happen to be doing it ahead of time, rather than at runtime. In principle, there's no reason why the same supply-chain security mitigations npm and other package managers / repositories have put in place could not also be applied in this case: you just apply them at download time, same as before, except now it might result in a runtime error instead of an npm install failure. (No idea if deno does this in its current state, tbh.) Agree, however, that blindly executing third-party code without somehow vetting it is a security risk. Also, re: Python - there's a reason why libraries like requests exist; while the Python Standard Library is pretty comprehensive, the APIs it exposes are not always the most intuitive. You might be surprised at how often people pull in helper libraries to work around some of its warts - now, one could argue that maybe they shouldn't do that and should just know the built-in modules better, just as one could argue that functionality is useless unless combined with usability.
  - jfkebwjsbx 6y ago
    Package managers are not red flags, the packages, its vendors and procedures behind those are. When you download a software update for your kernel you are trusting the Linux Foundation and your upstream vendor. They are supposed to have proper processes in place, they sign the binaries and may even have a support contract with you. When you put a random URL as a dependency, you are just trusting some random person over the Internet not to screw it up. Re: Python libraries. The topic of this thread was about "small scripts and tasks". The point of Python and its "batteries included" is that you don’t need external libraries to accomplish common tasks. It is a mistake to use external helper libraries in your scripts (not apps).
BiteCode_dev 6y ago
> Can you install any script from arbitrary urls using pip? You don't need to. Download any module or packgage, put it next to your code, and you can import it. There is nothing to do. There is not even need for metadata. But yes, pip can install packages from arbitrary URLS, including git repos, if they contains the right metadata. What's more, with something like shiv (https://github.com/linkedin/shiv https://github.com/linkedin/shiv), you can actually bundle those dependancies into one zipapp (an official python feature, see https://docs.python.org/fr/3/library/zipapp.html https://docs.python.org/fr/3/library/zipapp.html), which is basically a zip containing your entire project that you can just execute like if it were one py file.

jfkebwjsbx 6y ago

The whole point of Python is that you don't need external dependencies for "small tasks and scripts". A production "script" requiring downloads of third-party code from external servers is already a red flag, by the way.

searchableguy 6y ago
You can setup your own mirrors which don't update without audits. Any competent company would do. And I wasn't implying that production scripts shouldn't be self contained. Just placing my 2 cents on why.
- jfkebwjsbx 6y ago
  How is maintaining mirrors of third-party code any easier, reliable, secure or maintainable than just running Python? Mind you, your Python runtime has been vetted by the Python Foundation, your upstream vendor and your company; is used by many other companies and does not require any network connections to run.
candu 6y ago
One could extend that logic to argue that all package managers are red flags: after all, you're downloading third-party code from external servers; you just happen to be doing it ahead of time, rather than at runtime. In principle, there's no reason why the same supply-chain security mitigations npm and other package managers / repositories have put in place could not also be applied in this case: you just apply them at download time, same as before, except now it might result in a runtime error instead of an npm install failure. (No idea if deno does this in its current state, tbh.) Agree, however, that blindly executing third-party code without somehow vetting it is a security risk. Also, re: Python - there's a reason why libraries like requests exist; while the Python Standard Library is pretty comprehensive, the APIs it exposes are not always the most intuitive. You might be surprised at how often people pull in helper libraries to work around some of its warts - now, one could argue that maybe they shouldn't do that and should just know the built-in modules better, just as one could argue that functionality is useless unless combined with usability.
- jfkebwjsbx 6y ago
  Package managers are not red flags, the packages, its vendors and procedures behind those are. When you download a software update for your kernel you are trusting the Linux Foundation and your upstream vendor. They are supposed to have proper processes in place, they sign the binaries and may even have a support contract with you. When you put a random URL as a dependency, you are just trusting some random person over the Internet not to screw it up. Re: Python libraries. The topic of this thread was about "small scripts and tasks". The point of Python and its "batteries included" is that you don’t need external libraries to accomplish common tasks. It is a mistake to use external helper libraries in your scripts (not apps).

BiteCode_dev 6y ago

> Can you install any script from arbitrary urls using pip? You don't need to. Download any module or packgage, put it next to your code, and you can import it. There is nothing to do. There is not even need for metadata. But yes, pip can install packages from arbitrary URLS, including git repos, if they contains the right metadata. What's more, with something like shiv (https://github.com/linkedin/shiv https://github.com/linkedin/shiv), you can actually bundle those dependancies into one zipapp (an official python feature, see https://docs.python.org/fr/3/library/zipapp.html https://docs.python.org/fr/3/library/zipapp.html), which is basically a zip containing your entire project that you can just execute like if it were one py file.