7 ms·

The whole point of Python is that you don't need external dependencies for "small tasks and scripts". A production "script" requiring downloads of third-party

The whole point of Python is that you don't need external dependencies for "small tasks and scripts". A production "script" requiring downloads of third-party code from external servers is already a red flag, by the way.

searchableguy 6y ago
You can setup your own mirrors which don't update without audits. Any competent company would do. And I wasn't implying that production scripts shouldn't be self contained. Just placing my 2 cents on why.
- jfkebwjsbx 6y ago
  How is maintaining mirrors of third-party code any easier, reliable, secure or maintainable than just running Python? Mind you, your Python runtime has been vetted by the Python Foundation, your upstream vendor and your company; is used by many other companies and does not require any network connections to run.
candu 6y ago
One could extend that logic to argue that all package managers are red flags: after all, you're downloading third-party code from external servers; you just happen to be doing it ahead of time, rather than at runtime. In principle, there's no reason why the same supply-chain security mitigations npm and other package managers / repositories have put in place could not also be applied in this case: you just apply them at download time, same as before, except now it might result in a runtime error instead of an npm install failure. (No idea if deno does this in its current state, tbh.) Agree, however, that blindly executing third-party code without somehow vetting it is a security risk. Also, re: Python - there's a reason why libraries like requests exist; while the Python Standard Library is pretty comprehensive, the APIs it exposes are not always the most intuitive. You might be surprised at how often people pull in helper libraries to work around some of its warts - now, one could argue that maybe they shouldn't do that and should just know the built-in modules better, just as one could argue that functionality is useless unless combined with usability.
- jfkebwjsbx 6y ago
  Package managers are not red flags, the packages, its vendors and procedures behind those are. When you download a software update for your kernel you are trusting the Linux Foundation and your upstream vendor. They are supposed to have proper processes in place, they sign the binaries and may even have a support contract with you. When you put a random URL as a dependency, you are just trusting some random person over the Internet not to screw it up. Re: Python libraries. The topic of this thread was about "small scripts and tasks". The point of Python and its "batteries included" is that you don’t need external libraries to accomplish common tasks. It is a mistake to use external helper libraries in your scripts (not apps).

searchableguy 6y ago

You can setup your own mirrors which don't update without audits. Any competent company would do. And I wasn't implying that production scripts shouldn't be self contained. Just placing my 2 cents on why.

jfkebwjsbx 6y ago
How is maintaining mirrors of third-party code any easier, reliable, secure or maintainable than just running Python? Mind you, your Python runtime has been vetted by the Python Foundation, your upstream vendor and your company; is used by many other companies and does not require any network connections to run.

candu 6y ago

One could extend that logic to argue that all package managers are red flags: after all, you're downloading third-party code from external servers; you just happen to be doing it ahead of time, rather than at runtime. In principle, there's no reason why the same supply-chain security mitigations npm and other package managers / repositories have put in place could not also be applied in this case: you just apply them at download time, same as before, except now it might result in a runtime error instead of an npm install failure. (No idea if deno does this in its current state, tbh.) Agree, however, that blindly executing third-party code without somehow vetting it is a security risk. Also, re: Python - there's a reason why libraries like requests exist; while the Python Standard Library is pretty comprehensive, the APIs it exposes are not always the most intuitive. You might be surprised at how often people pull in helper libraries to work around some of its warts - now, one could argue that maybe they shouldn't do that and should just know the built-in modules better, just as one could argue that functionality is useless unless combined with usability.

jfkebwjsbx 6y ago
Package managers are not red flags, the packages, its vendors and procedures behind those are. When you download a software update for your kernel you are trusting the Linux Foundation and your upstream vendor. They are supposed to have proper processes in place, they sign the binaries and may even have a support contract with you. When you put a random URL as a dependency, you are just trusting some random person over the Internet not to screw it up. Re: Python libraries. The topic of this thread was about "small scripts and tasks". The point of Python and its "batteries included" is that you don’t need external libraries to accomplish common tasks. It is a mistake to use external helper libraries in your scripts (not apps).