Hacker News Reader

Comment by Ftuuky | Hacker News Reader

But no Python support as they promised. So sad.

One issue with embedding Python is that it's difficult to sandbox - to securely limit what the embedded runtime, and hence (potentially malicious) custom functions, can do:

> [The Python developers'] standard answer to "How do I sandbox Python code?" has been "Use a subprocess and the OS provided process sandboxing facilities" for quite some time. [1]

JavaScript, OTOH, is designed to support secure in-process sandboxing. Other languages with such support do exist (e.g. Lua), but JavaScript is by far the most widely known.

[1] https://mail.python.org/pipermail/python-dev/2013-November/1...

I think this is the real reason why we will never see Python inside Excel. The other, minor, reason is that Guido has pretty much pooped all over the idea of backwards compatibility in Python, which is pretty much integral to Microsoft's vision.

Other benefit is the web version can potentially run the javascript in the browser instead of waiting for a network call. Not sure what the security implications are here.

Didn't and doesn't stop them from using VBA, which of course is already used by malicious entities everywhere, so if they're unwilling to stop supporting that then why not let unsandboxed python work?

Good point. Another architectural difference between the languages is that Javascript is a [relatively] small language with a long history of working with external API's [i.e. the browser]. On the other hand, Python has extensive standard libraries that would require alignment with Excel. For example, how does csv.reader integrate? It looks like a can of "do the obvious thing" worms and a mountain of unexpected results and documentation.

Mostly, I think it comes down to Python being designed as a systems language rather than a scripting language. Integrating Python would seem to mean either a weak security model or a special (subset) version of Python. Neither is really going to meet the fat part of the Bell Curve...people who just want to get things done in Excel. Applying a 'browser abstraction' to Excel is probably better than applying an 'OS abstraction'. Anyway, JS has been a part of .NET and VS since JScript. Python, not so much.

> Python being designed as a systems language rather than a scripting language

Interesting - I hadn't really noticed how pronounced this dichotomy within dynamic languages is. On the one hand there are small languages designed for embedding and sandboxing (e.g. JavaScript, Lua, Tcl) and on the other hand, larger, more general-purpose languages (Perl, Python, Ruby).

I always assumed that a dynamic language could work well in both contexts, but in fact, most lie fundamentally on one side of the divide or the other. Only JavaScript, due to its immense popularity, has really managed (with Node.js) to expand from the first category into the second.

If Python were to be embedded in Excel, it would be expanding from the second category into the first. As you mention, to do this safely it may be necessary to create a special (subset) version of the language. Matz, the creator of Ruby, is trying to take his language in this direction with mruby [1] - a "lightweight implementation of Ruby complying to (part of) the ISO standard".

But, will these subset versions ever be popular? They necessarily leave the majority of the language's ecosystem behind - and knowledge of the full language will not necessarily transfer directly to the subset. Can a subset of an existing general-purpose language, even a widely-known one, compete against other languages that are specifically designed for safe embedding?

More generally, is it possible for a dynamic language to work well on both sides of the divide, or must all (even brand-new) languages choose one side or the other?

[1] https://github.com/mruby/mruby

I think the more important divide between language communities may be between consensus and individual authority. Python's BDFL and Javascript's standardization lie at opposite ends of the spectrum. To caricaturize: Javascript is the intersection of what many interested parties can agree on. Python is the union of anything that struck a single individual's fancy over the course of decades. The rise and fall of functional programming as Pythonic is a case study of the language community's arbitrariness (if Python2 v Python3 wasn't enough). As an aside, Ruby avoids this because it's vision is not tribal. Principle of least surprise allows for differences among programmers. Pythonic/unPythonic doesn't.

> There are many useful function types developers can enable with Machine Learning, such as:

> Any custom Python code, like a function to analyze text in cells.

Sounds like you'll probably be able to hack Excel into running whatever Python code you want using the Azure ML integrations. I guess it'll be Javascript the people currently writing VBA are pushed toward though.

If that's true, this stuff just changed the world more than half of the political issues that people march on streets about. The brightest people in office jobs around the world that aren't well integrated with developer teams (almost all of them) just got pushed to learn javascript, puke.

I get the appeal of "DAE hate JS" on Reddit where everyone upvotes you, but it seems out of place on a forum of professionals because JS is not much different than other dynamically-typed languages. I'd say it's better than Python which doesn't have async-by-default nor idiomatic closures. But "puke" is a bit childish.

I'd kind of assume everyone on HN has made their minds up about languages and I'm not qualified to change the opinions of any of them or even really try to be informative. So the puke is just for the (70% at a guess?) people who would agree that this is a bad choice.

Since I work with both python and javascript in exactly this dirty moving data around for analysts space (but haven't for long), I'll qualify a bit.

The most important point is that python absolutely brutally dominates the data science space, there are no javascript equivalents to the python ecosystem, it's not even close.

Secondary point is that javascript is much lower level than python in a language sense. Python already has classes built in, reflection, sane typing, just tons of batteries.

Javascript as someone smarter than me said before is lisp with C syntax. It's definitely possible to build a good language out of Javascript by using the right libraries and making decisions on how you're going to implement inheritance etc but it's just tons harder than python or almost any other language which has defaults on these decisions made for you. Guys automating their data flows aren't going to be at the level to make these decisions well but they will run into the same problems they solve and implement their own insane schemes.

I'd much much rather debug amateur VBA or Python than amateur javascript.

JavaScript has every feature you listed, plus a ton.

I'll give you the batteries included part, but you're missing the critical component here, which is Python's dep mgmt story is terrible. Pyenv seems cool, but it's basically NPM - which is a critical part of what they're trying to do here.

You can definitely mess up with python envs but JS absolutely doesn't have all the features I listed.

It doesn't have anything like python's built in power of classes, it's not just having a class syntax which is a thin wrapper around prototypes, it's having metaclasses, class decorators, properties, type comparison that works for inheritance, super().

It also doesn't have sane types/casts.

JavaScript by design supports both full OOP and full functional programming. There is no reason why you cannot implement what you mentioned in JavaScript.

> python absolutely brutally dominates the data science space

The language where when you 3/2 you get integer. Try R, the language created/developed by Statisricians for Statisticians. Python doesn't even have a buil-in support for missing data.

This is out of date, 3/2 is 1.5 in latest python.

I don't know what you mean by built in support for missing data but at language level there is None and in numpy/pandas there is np.NaN

They never promised Python support.

I think they were considering it, they even sent out a survey.

https://news.ycombinator.com/item?id=15927132

That's...very different from making a promise, though.

You're right. But since the feedback to their survey was so positive, I was really expecting it.

Reply on news.ycombinator.com