8 ms·

Hard to imagine the tradeoff of using a third party binary library developed this year vs just using urllib.parse being worth it. Is this solving a real problem

Hard to imagine the tradeoff of using a third party binary library developed this year vs just using urllib.parse being worth it. Is this solving a real problem?

pyuser583 3y ago
urlib.parse is a pain. We really need something more like pathlib.Path.
- masklinn 3y ago
  That used to be werkzeug.urls, kinda (it certainly had a more convenient API than urllib.parse), but it was killed in Werkzeug 3.
  - pyuser583 3y ago
    I remember and miss that. But I’m not going to install werkzeug just for the url parsing.
    - d_kahneman7 3y ago
      Is it that inconvenient?
      - pyuser583 3y ago
        It’s heavy. It’s a freaking server.
        masklinn 3y ago
        It’s a bunch of WSGI utilities. The server it provides is a thin layer over the stdlib’s HTTPServer.
- Ch00k 3y ago
  There is https://github.com/gruns/furl https://github.com/gruns/furl
  - AMCMneCy 3y ago
    Also https://github.com/aio-libs/yarl https://github.com/aio-libs/yarl
    - 4ec0755f5522 3y ago
      I use yarl as my default for this as well, it's been great to work with.
  - pyuser583 3y ago
    Yes! That’s the one I like!
  - VagabundoP 3y ago
    This library is very pythonic.
- joouha 3y ago
  You might be interested in https://github.com/fsspec/universal_pathlib https://github.com/fsspec/universal_pathlib
masklinn 3y ago
According to itself, it's solving the issue of parsing differentials vulnerabilities: urllib.parse is ad-hoc and pretty crummy, and the headliner function "urlparse" is literally the one you should not use under any circumstance: it follows RFC 1808 (maybe, anyway) which was deprecated by RFC 2396 25 years ago. The odds that any other parser uses the same broken semantics are basically nil.
- Areading314 3y ago
  It seems unlikely that this C++ library written by a solo dev is somehow more secure than the Python standard library would be for such a security-sensitive task.
  - masklinn 3y ago
    Not in the sense of differential vulnerabilities, since the standard library refuses to match any sort of modern standard. It's also 1. not a solo dev 2. Daniel Lemire 3. a serious engineering and research effort: https://arxiv.org/pdf/2311.10533.pdf https://arxiv.org/pdf/2311.10533.pdf
    - Areading314 3y ago
      This is the commit history: https://github.com/TkTech/can_ada/commits/main/ https://github.com/TkTech/can_ada/commits/main/ I guess you are right that there are 2 commits from a different dev, so it is technically not a solo project. I still wouldn't ever use this in production code.
      - bqmjjx0kac 3y ago
        The can_ada repo threw me off, too. It looks super amateurish because of the lack of tests, fuzzers, etc. But it appears that they've just exported the meat of the Ada project and left everything else upstream.
      - masklinn 3y ago
        ... can_ada is just the python bindings. The actual underlying project is at https://github.com/ada-url/ada https://github.com/ada-url/ada
deleted 3y ago
[deleted]
yagiznizipli 3y ago
Ada was developed in eoy 2022, and included in Node.js since March 2023. Since then, Ada powers Node.js, Cloudflare workers, Redpanda, Clickhouse and many more libraries.

Hard to imagine the tradeoff of using a third party binary library developed this year vs just using urllib.parse being worth it. Is this solving a real problem?

pyuser583 3y ago

urlib.parse is a pain. We really need something more like pathlib.Path.

masklinn 3y ago
That used to be werkzeug.urls, kinda (it certainly had a more convenient API than urllib.parse), but it was killed in Werkzeug 3.
- pyuser583 3y ago
  I remember and miss that. But I’m not going to install werkzeug just for the url parsing.
  - d_kahneman7 3y ago
    Is it that inconvenient?
    - pyuser583 3y ago
      It’s heavy. It’s a freaking server.
      - masklinn 3y ago
        It’s a bunch of WSGI utilities. The server it provides is a thin layer over the stdlib’s HTTPServer.
Ch00k 3y ago
There is https://github.com/gruns/furl https://github.com/gruns/furl
- AMCMneCy 3y ago
  Also https://github.com/aio-libs/yarl https://github.com/aio-libs/yarl
  - 4ec0755f5522 3y ago
    I use yarl as my default for this as well, it's been great to work with.
- pyuser583 3y ago
  Yes! That’s the one I like!
- VagabundoP 3y ago
  This library is very pythonic.
joouha 3y ago
You might be interested in https://github.com/fsspec/universal_pathlib https://github.com/fsspec/universal_pathlib

masklinn 3y ago

According to itself, it's solving the issue of parsing differentials vulnerabilities: urllib.parse is ad-hoc and pretty crummy, and the headliner function "urlparse" is literally the one you should not use under any circumstance: it follows RFC 1808 (maybe, anyway) which was deprecated by RFC 2396 25 years ago. The odds that any other parser uses the same broken semantics are basically nil.

Areading314 3y ago
It seems unlikely that this C++ library written by a solo dev is somehow more secure than the Python standard library would be for such a security-sensitive task.
- masklinn 3y ago
  Not in the sense of differential vulnerabilities, since the standard library refuses to match any sort of modern standard. It's also 1. not a solo dev 2. Daniel Lemire 3. a serious engineering and research effort: https://arxiv.org/pdf/2311.10533.pdf https://arxiv.org/pdf/2311.10533.pdf
  - Areading314 3y ago
    This is the commit history: https://github.com/TkTech/can_ada/commits/main/ https://github.com/TkTech/can_ada/commits/main/ I guess you are right that there are 2 commits from a different dev, so it is technically not a solo project. I still wouldn't ever use this in production code.
    - bqmjjx0kac 3y ago
      The can_ada repo threw me off, too. It looks super amateurish because of the lack of tests, fuzzers, etc. But it appears that they've just exported the meat of the Ada project and left everything else upstream.
    - masklinn 3y ago
      ... can_ada is just the python bindings. The actual underlying project is at https://github.com/ada-url/ada https://github.com/ada-url/ada

deleted 3y ago

[deleted]

yagiznizipli 3y ago

Ada was developed in eoy 2022, and included in Node.js since March 2023. Since then, Ada powers Node.js, Cloudflare workers, Redpanda, Clickhouse and many more libraries.