4 ms·
Nice feature. However uv is suspect at the moment, in the sense that it is designed as a pip replacement to overcome issues that only exist when supply chains a
by TZubiri 7mo ago
Nice feature. However uv is suspect at the moment, in the sense that it is designed as a pip replacement to overcome issues that only exist when supply chains are of a size that isn't safe to have.
So any project that has UV and any developer that tries to get uv into a project is on average less safe than a project that just uses pip and a requirements.txt
- Imustaskforhelp 7mo agoI really am not able to follow this line of reasoning, I am not sure if what you said makes sense and how it relates to uv having a security feature to be on average less safe :/
- thewebguyd 7mo agoI believe they are saying that by the time you need something like uv, your project already has too many dependencies. Its the unnecessarily large supply chain that's the problem, and uv exists to solve a problem that you should try to avoid in the first place. I think uv is great, but I somewhat agree. We see this issue with node/npm. We need smaller supply chains/less dependencies overall, not just bandaiding over the poor decisions with better dependency management tooling.
- Imustaskforhelp 7mo agoAh this simplifies what they were saying. I agree with it that dependency management should be made easier. To be honest, I really like how golang's dependency and how golang's community works around dependencies and how golang has a really great stdlib to work with and how the community really likes to rely on very little depenendencies for the most part as well. Maybe second to that, Zig is interesting as although I see people using libraries, its on a much lower level compared to rust/node/python. Sadly, rust suffers from the same dependency issue like node/python.
- catgary 7mo agoThis line of thought is honestly a bit silly - uv is just a package manager that actually does its job for resolving dependencies. You’re talking about a completely orthogonal problem.
- zahlman 7mo ago> uv is just a package manager that actually does its job for resolving dependencies. Pip resolves dependencies just fine. It just also lets you try to build the environment incrementally (which is actually useful, especially for people who aren't "developers" on a "project"), and is slow (for a lot of reasons).
- duskdozer 7mo agouv is really only something you need if you already aren't managing dependencies responsibly, imo.
- sdoering 7mo agoSorry - call me uninformed. But I do not really understand how choosing uv makes me less safe than using pip. Care to explain? Would love to learn.
- jcass8695 7mo agoIt is a bit of a leap. They are saying that if you are using uv, then you likely have a broad set of dependencies because you require a dependency management tool, therefore you are more susceptible to a supply chain attack by virtue of having a wider attack surface.
- sdoering 7mo agoAhhhhhh thanks a ton. Now I get it. Meaning I get what you are saying. Not what they were implying. But yeah. I can understand at least how one could arrive at that idea. To me personally this idea still sounds a bit off - but as a heuristic it might have some merit in certain circumstances.
- paulddraper 7mo agoHuh? Wanting a better pip means I am unsafe?
- joshred 7mo agoThis is complete nonsense. pip has all the same problems that you say uv has.
- cozzyd 7mo agoThe (not very convincing, IMO) argument is that pip becomes unergonikix for a certain dependency tree size leading people to use uv instead. Of course that's not the only or main reason people use uv, presumably.