3 ms·
12 billion downloads sounds like a lot for a packaging tool that calls eval on bytes found in yaml comments.
by JonChesterfield 3y ago
12 billion downloads sounds like a lot for a packaging tool that calls eval on bytes found in yaml comments.
- nurtbo 3y agoWhat’s the difference between putting it in the yaml file vs putting it in the uploaded built conda package? Isn’t it the same risk profile? Is there some way that new recipes are auto-parsed by every client?
- doctorpangloss 3y agoYou’re right. But the dysfunction in Python packaging is nothing new. Everything with adoption appeals to the lowest common denominator. Another POV is that “code conductors” have always vastly outnumbered actual programmers, but now that Python is ChatGPT’s expertise, does packaging matter? People will use whatever packages the LLM’s really cool notebook interface ships with, and nothing more. The environment doesn’t even have access to the Internet, and yet: here we are. The next 20 million Python developers - almost outnumbering all professional programmer combined - are going to get away with literally never installing a package.
- Someone 3y agoA yaml editor that does syntax coloring and wants to gray out lines that aren’t relevant to the current build might execute the code, but I hope they would at least sandbox that and, preferably opt out of supporting the full ’feature’, too.
- pavon 3y agoThe more popular alternative to conda is pip/venv, which also executes arbitrary python code in setup.py.
- akx 3y agoWhich is one reason why setup.py is on its way out. More often than not you'll just download a prebuilt wheel with pip anyway.