Hacker News Reader

Comment by WD-42 | Hacker News Reader

I don't get it. Having a complaint about Python removing CGI from the stdlib is well and fine. But then you say you'd rather consider JS, which doesn't even have a std lib? Lua doesn't have a CGI module in stdlib either.

View on HN

I think it's fine to not have functionality in the standard library if it can be implemented by including some code in my project. It's not fine to have a standard library that stuff disappears from over time.

Ruby has been removing stuff from stdlib for some time now. But "moving" is the correct word, because it is simply moved to a stand-alone gem, and with packaging situation in Ruby being so good, it feels completely seamless.

Whenever code is removed from the Java standard library it is announced ages ahead of time and then typically it becomes available in a separate artefact so you can still use it if you depended on it.

I wrote an online securities trading system in Java, with a little Jython. Java is reasonably good at stability, but I find it unappealing for other reasons, especially for prototyping. Kotlin might be okay.

Jython no longer works with basically any current Python libraries because it never made the leap to Python 3, and the Python community stigmatizes maintaining Python 2 compatibility in your libraries. This basically killed Jython, and from my point of view, Jython was one of the best things about Java.

Note that Jython was replaced by GraalPy, which does target Python 3

I hadn't heard about GraalPy! Thanks for the note.

It is fine though. CGI for python is one pip install away, as it is for the other languages you listed.

Most rational people are ok with code being removed that 99.99% of users have absolutely no use for, especially if it is unmaintained, a burden, or potentially contains security issues. If you are serious about cgi you’ll probably be looking at 3rd party modules anyway.

I don't think it's reasonable to expect that most python installs use pip

Why not?

I'm not sure what @LtWorf means, exactly, but one reason I can think of is that on Linux (Gentoo & Debian at least), the system package managers are not putting pip in place by default with python itself, the way they used to. The rationale, I believe, is to steer users towards using the system package manager or only doing ~/.local style things.

EDIT: So, you get threads like this https://stackoverflow.com/questions/65651040/what-is-the-rec... and so on

Presumably there’s a distro maintained python3-cgi package to install then which handles the need

https://packages.debian.org/sid/python3-legacy-cgi

Because it's much easier to use apt and install the module system-wide, and then I don't need to mess around with venv, requirements.txt, and there's someone that will fix any CVEs or malicious backdoors that get found out, automatically. Unlike what happens with venv.

It's much easier until you run into a package that doesn't have a .deb for it, like, well, CGI?

That is very much a self-inflicted wound, though. If you insist on not using the standard packaging solution for the language, you have to own the complications of that.

If you do insist on using pip, you will often find that it works very poorly or not at all if you are using an old version of either Python or some Python module. This is another aspect of the social backward compatibility problems in the current Python community.

https://packages.debian.org/sid/python3-legacy-cgi

Python has no standard packaging. They even deprecated and removed distutils (another terrible idea that caused a lot of busywork). The only way that python supports packages is via 3rd party external solutions.

Wheels are the standard Python packaging.

Source?

PEP 427

Describing a format and saying it's the standard are not one and the same.

Yeah, the distutils clusterfuck is another excellent reason someone might "insist on not using the standard packaging solution for the language": it's specifically and only the packages that did use the standard packaging solution for the language, distutils, that got broken when distutils was removed from the standard library.

I mean, I understand the desire to remove distutils. It sucked. It was the least Pythonic package in the whole Python standard library. But removing it was even worse, because it means you can't use old versions of most Python libraries with recent versions of Python.

You must be living in a different reality.

Yes mine. At work I don't use pip. We have thousands of servers all using python and none using pip or modules obtained via pip before imaging.

Personally… I don't use pip. Why? apt is there.

It’s easier for you to rely on the volunteers that maintain python packages for Debian. That’s fine, but if you need something niche like cgi, you might have to package it yourself.

Because pypi is managed by paid people?

Also I'm part of the python team in debian so I can package what's missing or update out of date things if I need.

I appreciate your work! The Python team in Debian has saved me an enormous amount of effort over the years.

I doubt I did anything you use ;)

The argument isn't about who has the standard lib, what I think Kragen is saying is that that the Python leadership has no qualms about removing functionality that people rely on and making up lame reasons to do so.

This feels like the spacebar heating argument. Sure, there’s probably a fraction of a percent that uses Python for CGI like that, but it’s not worth making all other support harder to have it.

> Lua doesn't have a CGI module in stdlib either.

Lua barely has any stdlib to speak of, most notably in terms of OS interfaces. I'm not even talking about chmod or sockets; there's no setenv or readdir.

You have to install C modules for any of that, which kinda kills it for having a simple language for CGI or scripting.

Don't get me wrong, I love Lua, but you won't get far without scaffolding.

Right, you need something more specific than Lua to actually write most complete programs in. The LuaJIT REPL does provide a C FFI by default, for example, so you don't need to install C modules.

But my concern is mostly not about needing to bring my own batteries; it's about instability of interfaces resulting from evaporating batteries.

Honestly, I'm not worried about the batteries. Thanks to FFI, you can just talk to libc, and vendor any native Lua code you need. (That's my approach for LÖVE.)

LuaJIT, release-wise, has been stuck in a very weird spot for a long time, before officially announcing it's now a "rolling release" - which was making a lot of package maintainers anxious about shipping newer versions.

It also seems like it's going to be forever stuck on the 5.1 revision of the language, while continuing to pick a few cherries from 5.2 and 5.3. It's nice to have a "boring" language, but most distros (certainly Alpine, Debian, NixOS) just ship each release branch between 5.1 and 5.4 anyway. No "whatever was master 3 years ago" lottery.

Node.js provides the defacto standard lib for JS backend and its got a good feature set.

That said these days I'd rather use Go.

Golang seems pretty comfortable from the stuff I've done in it, but it's not as oriented toward prototyping. It's more oriented toward writing code that's long-term maintainable even if that makes it more verbose, which is bad for throwaway code. And it's not clear how you'd use Golang to do the kind of open-ended exploration you can do in a Jupyter notebook, for example. How would you load new code into a Golang program that's already running?

Admittedly Python is not great at this either (reload has interacted buggily with isinstance since the beginning), but it does attempt it.

There are live reload utilities for Go but yeah it comes down to recompiling and restarting - which is quick but any state is gone.

I agree its not a rapid prototyping kind of language. AI assistance can help though.

Can you load new code into a Node.js program that's running?

`eval()` to run new code and `delete require.cache` (to reload a module)

Hmmm... Can you eval entire files?

That's essentially what browsers do.

This is a question about the details of the Lua interpretation, for which it is not relevant what browsers do, because they do not use Lua.

Yes.

Reply on news.ycombinator.com