3 ms·

Why would you even use python without uv anymore, and have a system python binary and virtual envs linked to it?

by 9dev 13d ago

atmosx 13d ago
Python might be just one of the languages required by the dev stack not the only language. Mise is the right tool for the job.
- 9dev 13d ago
  Last time I checked, Mise is still a one-man show. That’s way too risky for a critical party of my supply chain for my taste.
  - doodlesdev 13d ago
    So is sudo... And that's not "too risky" for the entire industry. That's not to say bus factor is irrelevant (I personally think about it a lot when choosing software projects), but truthfully the bus factor here especially doesn't matter much, as mise is an easy tool to replace (with asdf, for example) if something goes wrong with it eventually. I highly recommend trying it out. I resisted using it for some time, but it solved some pain points I had with NodeJS, Ruby, and Python regarding installation.
    - 9dev 12d ago
      > So is sudo... And that's not "too risky" for the entire industry. Sure it is, and that's why I'm looking forward to systemd's Run0 -- but for now, there's just no way around the sudo package. That's different for Mise, though, because there are a lot of ways to work productively without it. I'm not fond of consciously adding supply chain vulnerabilities to our stack when I don't have real pain to do so.
      - doodlesdev 11d ago
        > Sure it is, and that's why I'm looking forward to systemd's Run0 -- but for now, there's just no way around the sudo package. Regarding Run0, I'd prefer to not rely so much on Polkit authentication after crazy vulnerabilities such as PwnKit (a pkexec vuln, but a good reminder that moving the security boundary won't magically solve issues). > I'm not fond of consciously adding supply chain vulnerabilities to our stack when I don't have real pain to do so. I SUPER agree with you on that, btw. It's just likely that mise solves a problem which is much bigger for me than it is for you. Honestly, I'd prefer if I could manage everything with my distro packages, but, for a multitude of reasons, they're rarely enough for development tooling with multiple versions and environments.
  - jdxcode 13d ago
    this makes no sense to me, the reason i don't give anyone else the commit bit is only to _protect_ the supply chain. you should want as few people with that access as possible.
    - OberstKrueger 13d ago
      I think the concern is more if something happens to you or stop development for any reason, then the project is dead or would fork in a few separate directions
    - weaksauce 13d ago
      do you have any kind of succession plan in place in case you get incapacitated for one reason or another? anyone you trust enough for that?
      - jdxcode 13d ago
        Yes I have a friend that can access my GitHub if I were to die and he would be in charge of deciding who would lead the project
    - someguyiguess 12d ago
      The bus factor makes no sense to you? https://en.wikipedia.org/wiki/Bus_factor https://en.wikipedia.org/wiki/Bus_factor
- zbentley 13d ago
  True, but Python is the one with an env management system (virtual environments) which is the most prone to breakage for projects that depend on system Python. Uv is far superior to both Mise and Homebrew for Python work, and I find that it removes the vast majority of pain preventing me from using Homebrew by default for most things, and Mise only occasionally for specific dev envs. Mise is a great tool though!
e12e 13d ago
> Why would you even use python without uv anymore Probably wouldn't: https://mise.jdx.dev/mise-cookbook/python.html#mise-uv https://mise.jdx.dev/mise-cookbook/python.html#mise-uv > have a system python binary and virtual envs linked to it I'm not sure if you're saying avoid using system python? In my experience so far, you never want to develop complex software locked to system versions of runtimes. Too often you need a bleeding edge feature, or conversely need to postpone updating due to needing an old version for some reason.
- maxloh 12d ago
  Old Mise user too. Now that PNPM supports managing runtimes [0], I found that most of Mise's offerings are actually built into package managers. Maybe I will have it graduates from my machine when I have time. [0]: https://pnpm.io/cli/runtime https://pnpm.io/cli/runtime
  - e12e 12d ago
    That's the beauty of asdf and then mise; they leverage existing solutions where possible, and unify how to get versioned runtimes for projects. Rust? rustup with mise, ruby? Precompiled when possible, otherwise ruby-build. Etc. I'm not sure if I trust or want pnpm to support bundling rust for binary plugins, or various sundry toolchains. But use what works for you.
- 9dev 12d ago
  > I'm not sure if you're saying avoid using system python? That's what I'm saying, yes. System python should be treated as a REPL for interactive shell scripting and otherwise ignored entirely.

Why would you even use python without uv anymore, and have a system python binary and virtual envs linked to it?

by 9dev 13d ago

Why would you even use python without uv anymore, and have a system python binary and virtual envs linked to it?

Python might be just one of the languages required by the dev stack not the only language. Mise is the right tool for the job.

9dev 13d ago
Last time I checked, Mise is still a one-man show. That’s way too risky for a critical party of my supply chain for my taste.
- doodlesdev 13d ago
  So is sudo... And that's not "too risky" for the entire industry. That's not to say bus factor is irrelevant (I personally think about it a lot when choosing software projects), but truthfully the bus factor here especially doesn't matter much, as mise is an easy tool to replace (with asdf, for example) if something goes wrong with it eventually. I highly recommend trying it out. I resisted using it for some time, but it solved some pain points I had with NodeJS, Ruby, and Python regarding installation.
  - 9dev 12d ago
    > So is sudo... And that's not "too risky" for the entire industry. Sure it is, and that's why I'm looking forward to systemd's Run0 -- but for now, there's just no way around the sudo package. That's different for Mise, though, because there are a lot of ways to work productively without it. I'm not fond of consciously adding supply chain vulnerabilities to our stack when I don't have real pain to do so.
    - doodlesdev 11d ago
      > Sure it is, and that's why I'm looking forward to systemd's Run0 -- but for now, there's just no way around the sudo package. Regarding Run0, I'd prefer to not rely so much on Polkit authentication after crazy vulnerabilities such as PwnKit (a pkexec vuln, but a good reminder that moving the security boundary won't magically solve issues). > I'm not fond of consciously adding supply chain vulnerabilities to our stack when I don't have real pain to do so. I SUPER agree with you on that, btw. It's just likely that mise solves a problem which is much bigger for me than it is for you. Honestly, I'd prefer if I could manage everything with my distro packages, but, for a multitude of reasons, they're rarely enough for development tooling with multiple versions and environments.
- jdxcode 13d ago
  this makes no sense to me, the reason i don't give anyone else the commit bit is only to _protect_ the supply chain. you should want as few people with that access as possible.
  - OberstKrueger 13d ago
    I think the concern is more if something happens to you or stop development for any reason, then the project is dead or would fork in a few separate directions
  - weaksauce 13d ago
    do you have any kind of succession plan in place in case you get incapacitated for one reason or another? anyone you trust enough for that?
    - jdxcode 13d ago
      Yes I have a friend that can access my GitHub if I were to die and he would be in charge of deciding who would lead the project
  - someguyiguess 12d ago
    The bus factor makes no sense to you? https://en.wikipedia.org/wiki/Bus_factor https://en.wikipedia.org/wiki/Bus_factor
zbentley 13d ago
True, but Python is the one with an env management system (virtual environments) which is the most prone to breakage for projects that depend on system Python. Uv is far superior to both Mise and Homebrew for Python work, and I find that it removes the vast majority of pain preventing me from using Homebrew by default for most things, and Mise only occasionally for specific dev envs. Mise is a great tool though!

e12e 13d ago

> Why would you even use python without uv anymore Probably wouldn't: https://mise.jdx.dev/mise-cookbook/python.html#mise-uv https://mise.jdx.dev/mise-cookbook/python.html#mise-uv > have a system python binary and virtual envs linked to it I'm not sure if you're saying avoid using system python? In my experience so far, you never want to develop complex software locked to system versions of runtimes. Too often you need a bleeding edge feature, or conversely need to postpone updating due to needing an old version for some reason.

maxloh 12d ago
Old Mise user too. Now that PNPM supports managing runtimes [0], I found that most of Mise's offerings are actually built into package managers. Maybe I will have it graduates from my machine when I have time. [0]: https://pnpm.io/cli/runtime https://pnpm.io/cli/runtime
- e12e 12d ago
  That's the beauty of asdf and then mise; they leverage existing solutions where possible, and unify how to get versioned runtimes for projects. Rust? rustup with mise, ruby? Precompiled when possible, otherwise ruby-build. Etc. I'm not sure if I trust or want pnpm to support bundling rust for binary plugins, or various sundry toolchains. But use what works for you.
9dev 12d ago
> I'm not sure if you're saying avoid using system python? That's what I'm saying, yes. System python should be treated as a REPL for interactive shell scripting and otherwise ignored entirely.