3 ms·

Most of the time, git clone URL cd PROJECTNAME gets you most of the way there. For Rust, cargo test usually takes care of all the dependencies and

Most of the time, git clone URL cd PROJECTNAME gets you most of the way there. For Rust, cargo test usually takes care of all the dependencies and building. The old days of ./autoconf make are over, but there are modern replacements. Python and Javascript have too many build and install systems and much worse versioning problems.

zelphirkalt 2y ago
And as someone mostly working with Python, I can tell you, while there are good solutions to have reproducible setups, the mindset of people is just not there yet. People don't care enough or are too shortsighted to get it.
- Joel_Mckay 2y ago
  The problem with out-of-band package systems is a lack of quality control, and accountability. Entire ecosystems emerged to handle Python Environment specific version issues, and often ignored a systemic underlying legacy library deprecation (same code may not work in 10 months). Despite personal opinions on Rust use-cases/scope-creep (why not use a higher level llvm language if you want safer syntax.) Cargo like npm, php pear, and pip3 etc. traded convenience for long-term security rot, high maintenance cycles, and version instability within downstream source code. i.e. the proponents will likely feel like they are in perpetual Beta, as dependent resources permute under conflicting use-cases. People often confuse convenience with Workmanship Standards, and rotten code trees in any language have the same result. This is not a new phenomena ( https://en.wikipedia.org/wiki/Second-system_effect https://en.wikipedia.org/wiki/Second-system_effect ) =3
  - zelphirkalt 2y ago
    Only recently had someone "update" a thing, and in the process throwing reproducibility and checksums all out of the window. Told that person, that they built a nice prototype, but that those things need to be reintroduced to the thingy. But that person doesn't see the need. I guess some people just build throwaways all day every day. When in 2 months someone else wants to build the thing, it might simply not build any longer, because that dude did not pay attention to reproducibility at all. This attitude seems to be wide-spread in Python land, unfortunately. Even prominent packages don't properly lock their versions and hashes. Many people deliver, I dare say, shoddy work.
skybrian 2y ago
Go is pretty good, too.

zelphirkalt 2y ago

And as someone mostly working with Python, I can tell you, while there are good solutions to have reproducible setups, the mindset of people is just not there yet. People don't care enough or are too shortsighted to get it.

Joel_Mckay 2y ago
The problem with out-of-band package systems is a lack of quality control, and accountability. Entire ecosystems emerged to handle Python Environment specific version issues, and often ignored a systemic underlying legacy library deprecation (same code may not work in 10 months). Despite personal opinions on Rust use-cases/scope-creep (why not use a higher level llvm language if you want safer syntax.) Cargo like npm, php pear, and pip3 etc. traded convenience for long-term security rot, high maintenance cycles, and version instability within downstream source code. i.e. the proponents will likely feel like they are in perpetual Beta, as dependent resources permute under conflicting use-cases. People often confuse convenience with Workmanship Standards, and rotten code trees in any language have the same result. This is not a new phenomena ( https://en.wikipedia.org/wiki/Second-system_effect https://en.wikipedia.org/wiki/Second-system_effect ) =3
- zelphirkalt 2y ago
  Only recently had someone "update" a thing, and in the process throwing reproducibility and checksums all out of the window. Told that person, that they built a nice prototype, but that those things need to be reintroduced to the thingy. But that person doesn't see the need. I guess some people just build throwaways all day every day. When in 2 months someone else wants to build the thing, it might simply not build any longer, because that dude did not pay attention to reproducibility at all. This attitude seems to be wide-spread in Python land, unfortunately. Even prominent packages don't properly lock their versions and hashes. Many people deliver, I dare say, shoddy work.

skybrian 2y ago

Go is pretty good, too.