Hacker News Reader

Comment by esseph | Hacker News Reader

This is one of the problems that containers help solve - no OS, just the dependencies required to run your code.

Python even has venv and other tooling for this sort of thing. Though, admittedly I seem to have dodged most of this by not seriously writing lots of python until after Python3 had already happened. With any luck the maintainers of the language have factored that negative backlash into future language plans, but we'll see.

Mostly I recoiled in horror at bash specifically, which in addition to bash version, also ends up invisibly depending on a whole bunch of external environment stuff that is also updating constantly. That's sortof bash's job, so it's still arguably the right tool to write that sort of interface, but it ends up incredibly fragile as a result. Porting a complex bash script to a different distro is a giant pain.

How many times the virtualenv/pipenv/pyenv/... changed though? The package management also between wheels and setup and all the breakages.

Even for somebody that did not aim to have python programs for 20y, python is definitely not a good example of a "pdf for programs"

I dislike Python for that reason. I don't love the offside-rule syntax, but compared to how often I have an issue with software written in Python due to some old/deprecated/broken packaging issue...

I've lately been pretty deep into 3d printing, and basically all the software has Python...and breaks quite easily. Whether because of a new version of Pip with some new packaging rule, forced venvs...I really don't like dealing with Python software.

I used virtualenv for the past 15 years and I don't recall it changing significantly. I don't get why people use new fancy tools like pipenv/pyenv/poetry/uv and then complain that there are too many tools to learn. There is nothing wrong with just using virtualenv. It has its warts but it always worked for me and it's stable.

If you see a wart report it: https://github.com/pypa/virtualenv/issues/

I think if you had chased every single latest hotness then you would have hit lots of breakages, but depending on what you are doing and where you are running (and what dependencies you are using) then I think you could easily have something from 10-15 years ago work today. Part of the trick would have been to aware enough to pick the boring long-term options (but at some level that applies to every language and ecosystem), but the other part is understanding what the tools are actually doing and how they are maintained.

uv means you have to download something and put it together.

A container has that already done, including all supporting libraries.

Edit: then ship the bash script in a container with a bash binary ;)

It is also quite possible for old containers to no longer build.

That's why your build pipeline alerts you when tests no longer work, and then you have a release of the previous build still available for download at any time. This is how containers are released!

Sure. It still is burdensome, though. Now there are lots of nightly build from old projects that break at random times and require developer attention.

You just described all software, for the decades it often runs.

Entropy sucks.

The point of the article is that this does not have to be the case, and is not the case for all software.

There's a lot of software that ends up lasting for decades, through multiple OS platform refreshes. Normally there's a small platform/OS team that gets to slog through gardening that mess while everyone else is long gone.

But now I have frozen an old language runtime and a bunch of old libraries into my environment, all of which are not just security hazards but interoperability landmines (a common one being lack of support for a new TLS standard).

Write a wrapper, don't expose the container.

These are different problems from the distribution/bundling piece, they won't be solved the same way.

I don't see how that solves either problem. If the thing in the container makes a web request out, that code both might become obsolete and offers an attack surface to get back in, and wrapping the outside of it doesn't change anything.

As far as TLS is concerned it does: if you are running a server, run it through a TLS terminating reverse proxy. If you are running a client, run it through a TLS terminating forward proxy. As long as your application logic isn't exposed to a security issue, you're fine.

Reply on news.ycombinator.com