4 ms·

I really am not able to follow this line of reasoning, I am not sure if what you said makes sense and how it relates to uv having a security feature to be on av

I really am not able to follow this line of reasoning, I am not sure if what you said makes sense and how it relates to uv having a security feature to be on average less safe :/

thewebguyd 7mo ago
I believe they are saying that by the time you need something like uv, your project already has too many dependencies. Its the unnecessarily large supply chain that's the problem, and uv exists to solve a problem that you should try to avoid in the first place. I think uv is great, but I somewhat agree. We see this issue with node/npm. We need smaller supply chains/less dependencies overall, not just bandaiding over the poor decisions with better dependency management tooling.
- Imustaskforhelp 7mo ago
  Ah this simplifies what they were saying. I agree with it that dependency management should be made easier. To be honest, I really like how golang's dependency and how golang's community works around dependencies and how golang has a really great stdlib to work with and how the community really likes to rely on very little depenendencies for the most part as well. Maybe second to that, Zig is interesting as although I see people using libraries, its on a much lower level compared to rust/node/python. Sadly, rust suffers from the same dependency issue like node/python.
- catgary 7mo ago
  This line of thought is honestly a bit silly - uv is just a package manager that actually does its job for resolving dependencies. You’re talking about a completely orthogonal problem.
  - zahlman 7mo ago
    > uv is just a package manager that actually does its job for resolving dependencies. Pip resolves dependencies just fine. It just also lets you try to build the environment incrementally (which is actually useful, especially for people who aren't "developers" on a "project"), and is slow (for a lot of reasons).
  - duskdozer 7mo ago
    uv is really only something you need if you already aren't managing dependencies responsibly, imo.

I really am not able to follow this line of reasoning, I am not sure if what you said makes sense and how it relates to uv having a security feature to be on average less safe :/

thewebguyd 7mo ago

I believe they are saying that by the time you need something like uv, your project already has too many dependencies. Its the unnecessarily large supply chain that's the problem, and uv exists to solve a problem that you should try to avoid in the first place. I think uv is great, but I somewhat agree. We see this issue with node/npm. We need smaller supply chains/less dependencies overall, not just bandaiding over the poor decisions with better dependency management tooling.

Imustaskforhelp 7mo ago
Ah this simplifies what they were saying. I agree with it that dependency management should be made easier. To be honest, I really like how golang's dependency and how golang's community works around dependencies and how golang has a really great stdlib to work with and how the community really likes to rely on very little depenendencies for the most part as well. Maybe second to that, Zig is interesting as although I see people using libraries, its on a much lower level compared to rust/node/python. Sadly, rust suffers from the same dependency issue like node/python.
catgary 7mo ago
This line of thought is honestly a bit silly - uv is just a package manager that actually does its job for resolving dependencies. You’re talking about a completely orthogonal problem.
- zahlman 7mo ago
  > uv is just a package manager that actually does its job for resolving dependencies. Pip resolves dependencies just fine. It just also lets you try to build the environment incrementally (which is actually useful, especially for people who aren't "developers" on a "project"), and is slow (for a lot of reasons).
- duskdozer 7mo ago
  uv is really only something you need if you already aren't managing dependencies responsibly, imo.