3 ms·

... or leaving you at GitHub (or GitLab, or SourceHut). You can pip install a git repo directly, and specify tag, or a hosted release tarball. If only the ~ 10k

... or leaving you at GitHub (or GitLab, or SourceHut). You can pip install a git repo directly, and specify tag, or a hosted release tarball. If only the ~ 10k most used python packages were available from pypi, and the more niche ones had to be more directly referenced from their own repos or websites, I'd be fine with that. I'm accustomed to that for C libraries, distros provide the most common/core few thousand of them, the rest you can get yourself, it's doable. Minimize your dependencies, its better engineering anyway.

eesmith 3y ago
Does the lack of comment about "time bomb" mean anything regarding your misapprehension that the xscreensaver code made the program stop working on a certain date? I meant 'PyPI' as synecdoche, yes, for a large number of alternatives which cannot meaningfully be described as "reinventing Linux distributions". Those three quoted words were bscphil's claim. My counter-claim is we are not, and further, the approach Linux distributions use is not able to handle what people already use PyPI for. > and the more niche ones had to be more directly referenced from their own repos or websites These are still not "reinventing Linux distributions". > If only the ~ 10k most used python packages were available from pypi, and the more niche ones had to be more directly referenced from their own repos or websites How do you determine the top ~10K if some 450K packages are distributed across a variety of platforms? If a package leaves the top-10K, is it removed? How much breakage will that cause? Or, once it reaches the 10K level, does it stays on PyPI forever? Why do you think this will result in reducing the amount of malware? Seems to me it opens the attack surface, and makes it harder for anti-malware scanners to get a good oversight of the large portion of what people use. > distros provide the most common/core few thousand of them Are you sure you aren't agreeing with me? The Linux distros are already unable to manage the packages in my field. That's why "reinventing Linux distributions" will not work, if forced to scale up 7x and handle niche area. That's why people use other methods, like PyPI and Anaconda, to handle what the distros cannot.

eesmith 3y ago

Does the lack of comment about "time bomb" mean anything regarding your misapprehension that the xscreensaver code made the program stop working on a certain date? I meant 'PyPI' as synecdoche, yes, for a large number of alternatives which cannot meaningfully be described as "reinventing Linux distributions". Those three quoted words were bscphil's claim. My counter-claim is we are not, and further, the approach Linux distributions use is not able to handle what people already use PyPI for. > and the more niche ones had to be more directly referenced from their own repos or websites These are still not "reinventing Linux distributions". > If only the ~ 10k most used python packages were available from pypi, and the more niche ones had to be more directly referenced from their own repos or websites How do you determine the top ~10K if some 450K packages are distributed across a variety of platforms? If a package leaves the top-10K, is it removed? How much breakage will that cause? Or, once it reaches the 10K level, does it stays on PyPI forever? Why do you think this will result in reducing the amount of malware? Seems to me it opens the attack surface, and makes it harder for anti-malware scanners to get a good oversight of the large portion of what people use. > distros provide the most common/core few thousand of them Are you sure you aren't agreeing with me? The Linux distros are already unable to manage the packages in my field. That's why "reinventing Linux distributions" will not work, if forced to scale up 7x and handle niche area. That's why people use other methods, like PyPI and Anaconda, to handle what the distros cannot.