Hacker News Reader

Comment by Animats | Hacker News Reader

Most of the time,

   git clone URL
   cd PROJECTNAME

gets you most of the way there.

For Rust,

   cargo test

usually takes care of all the dependencies and building.

The old days of

   ./autoconf
   make

are over, but there are modern replacements.

Python and Javascript have too many build and install systems and much worse versioning problems.

View on HN

And as someone mostly working with Python, I can tell you, while there are good solutions to have reproducible setups, the mindset of people is just not there yet. People don't care enough or are too shortsighted to get it.

The problem with out-of-band package systems is a lack of quality control, and accountability. Entire ecosystems emerged to handle Python Environment specific version issues, and often ignored a systemic underlying legacy library deprecation (same code may not work in 10 months).

Despite personal opinions on Rust use-cases/scope-creep (why not use a higher level llvm language if you want safer syntax.) Cargo like npm, php pear, and pip3 etc. traded convenience for long-term security rot, high maintenance cycles, and version instability within downstream source code.

i.e. the proponents will likely feel like they are in perpetual Beta, as dependent resources permute under conflicting use-cases.

People often confuse convenience with Workmanship Standards, and rotten code trees in any language have the same result. This is not a new phenomena ( https://en.wikipedia.org/wiki/Second-system_effect ) =3

Only recently had someone "update" a thing, and in the process throwing reproducibility and checksums all out of the window. Told that person, that they built a nice prototype, but that those things need to be reintroduced to the thingy. But that person doesn't see the need. I guess some people just build throwaways all day every day. When in 2 months someone else wants to build the thing, it might simply not build any longer, because that dude did not pay attention to reproducibility at all.

This attitude seems to be wide-spread in Python land, unfortunately. Even prominent packages don't properly lock their versions and hashes. Many people deliver, I dare say, shoddy work.

Go is pretty good, too.

Reply on news.ycombinator.com