Comment by bobjordan | Hacker News Reader

Comment by bobjordan | Hacker News Reader

So I've been working on a python flask web app in part time/spare time for my business for almost two years (in addition to running a company doing several million USD in sales over that time without the app.) In that two years, I've tracked my programming time with wakatime and I'm at >1000hrs now, more than 25 full-time 40hr work weeks of actual coding time. I'm running the app on a dedicated GPU server, as part of the apps function is to evaluate 3D CAD files. Time spent managing and running a dedicated server is not even counted in the 1000hrs. Of course, I've also had to learn to be a Postgres database admin and dozens of support libraries. And, certainly must have at least some javascript/jquery. Libraries like flask-admin and flask-security are great. But, when you need them customized for production, it takes weeks of time to dig in and actually learn how they are built from the inside out. Need to subclass and override much of it to finally have something usable. I literally just spent about a month hacking on flask-security to get the login/email-confirmations/email templates/argon2-hashing/2-factor-auth the way I need it. Then, I watch this video the guy replicates most of the functionality in six minutes. Nice work, definitely looks like heading in right direction.

I would bet that you would need about the same amount of time nomatter what technology you used. The catch is this sentence:

> I literally just spent about a month hacking on flask-security to get the login/email-confirmations/email templates/argon2-hashing/2-factor-auth the way I need it.

I don't know Anvil but I am sure it has a specific way of dealing with login/signup/... - just like every other framework. And if you want to modify it, well, that takes time. And I am guessing it was the same with other tasks.

There is nothing wrong with that, of course. Just saying. :)

I'd take the other side of that bet ;)

Anvil's built in "Users" service is incredibly simple and un-magical (user records are just database rows, and you can reimplement vanilla password login in four lines). This makes hacking on it an awful lot easier than some magically injected extension that needs to be configured just so.

(Check out the API: https://anvil.works/doc#users)

My personal experience with Flask has led me to believe it's many times easier to expand on vanilla Flask then it is to try and incorporate any of the flask-* libraries.

I ended up with writing my own flask extension that integrates some useful flask-* libraries and client-side JS libraries in very opinionated way. Somewhat ironically I'm currently in process of spliting that into separate flask extensions...

Having just built a boilerplate that integrates a bunch of the flask-* libraries, I think the key really is that you need to be careful about how you organize your code: it's important to be able to control the order of registering the various extensions you're using relative to when you're registering your app code. Otherwise you're going to end up in circular-dependency import hell. Buried in the documentation is a hint on how to do this correctly with application factories[0], but if you don't know that's there, it's very hard to just stumble upon how to correctly organize everything.

[0] http://flask.pocoo.org/docs/0.12/patterns/appfactories/

Flask never really seemed like a very mature framework to me, it got so many strange inconsistencies and very dubious design choices I much prefer newer, significantly simpler frameworks.

One example is the way the request context works in flask, I venture to say thats just terrible software design in my book (from flask import request, g). And seriously to have your framework give you a "global" variable to put random stuff in, wth?

Also I rather not use Flask-SQLAlchemy since why should my database models be tied so incredibly closely to some library of my web MICRO framework, it doesn't make sense, I mean its not django why introduce this coupling?

It seems if you need all the dependent libraries (like webassets and wtforms) just use django from the get go instead of going through the pain of trying to cleanly integrate dozens of flask libraries.

To see how a proper simple middleware-based framework should look like consider express, koa (nodejs), or bottle, falcon. Aiohttp and tornado also have their place of course.

My personal experience with http is that you parse url and cookies by hand and never bother to use any crap “framework”. Of course, it has to be reverse-proxied with all irrelevant headers cleared, e.g. via nginx, which can also serve /static efficiently and provide https-http conversion. If you’re familiar with Lua, then writing http to json-only or binary-only unix socket is a no brainer in OpenResty, so you can skip backend-side parsing at all.

Flask/etc was useful magic only until I figured out what it really does between me and underlying socket.

I'm curious what you're using to evaluate the CAD files? Do you mind sharing that information?

I went from learning Python with Bottle, moved to Flask, found I was reinventing the wheel with just about everything, wasted vast amounts of time trying to integrate basic functionality from third party Flask libraries for things like auth and cookies, moved on to Falcon for building APIs, and finally arrived at AWS Lambda with Python and Cognito. Its now six years into the journey of turning myself into a complete full stack developer with database, back end and front end skills.

With AWS Lambda, Python, AWS Cognito, Postgres and ReactJS I can build large scale complete applications.

I think I'm vastly more productive today than I was then. That's partly a function of being a much better programmer in general, partly about now having developed expertise with my chosen technology set.

There's no way I'd go back to something as bare bones as Bottle or Flask any more. If I had to use a Python framework I'd look at a batteries included system like Django. As I say however, I've settled on Lambda, Cognito, Python, Postgres and ReactJS. I've done the hard yards... years of learning and many thousands of lines of code written.

>> Need to subclass and override much of it to finally have something usable.

This is really not something you should be spending your minimal available programming time doing.

But now you are locked to AWS.

After having done it a few times I personally don't find Flask auth very time consuming to implement.

But I'll admit I really like Flask. I find it just the right approach between something simple and something that can be much more complex with extensions. I don't like all of the extension (WTF Forms for instance can do without and SQL Alchemy usually is better independent of Flask IMOP) but these don't need to be used. I've stuck with Flask as much as possible over the years and that alone has led to a huge productivity increase for me because of familiarity.

awesome stuff, I never tracked my time but would have done similar hours over 2 years on iOS/Android/Python-Flask & Flask-Security. Doing a rebuild now I have scaled and have a team and am using Auth0, and thankfully I am grateful for the abstraction!

Reply on news.ycombinator.com