Hacker News Reader

Comment by GeorgeTirebiter | Hacker News Reader

I had heavily used PySimpleGUI in various work projects, and one day, when I had to run some older piece of code I had not run in a while, I get a notice that PySimpleGUI won't work, because was free, but nobody paid, and so, good luck! So I was piping mad, paid the 3-year or whatever the max license fee was, received a code, and THEN I was able to get my stuff to work, like it used to.

LESSON: N E V E R Use code that can "stop working" until you pay ransom. N E V E R.

At this point, it's irrelevant, because the LLMs can replace PySimpleGUI with PyQt etc so --- thanks but no thanks. I did like it because you could throw up something around a CLI and it looked at least presentable. Now, since 2025, nobody codes anymore, so ... seems to me, this PySimpleGUI 6 is just a bit of history.

View on HN

> never use code that can stop working until you pay ransom

Funny because that describes pretty much exactly "cloud-first" software architecture, and people jumping on it in troves, unexplainably.

I suppose at some point enough of them will get burned, there will be a swing back and everything old will be new again, and so on and so on.

Given it was older code, were you not able to use an older version of pysimplegui that was freely available?

The problem with old Python code is that you then have to hunt for exactly the right version of the right libraries that can work together when the stars are aligned.

Isn't that true of any packaging system? (npm, RubyGems, etc) Perhaps it's a bit easier, with the respective spec files, but it's still a bit of a hunt.

No. Decent packaging systems like used in the Java world have deterministic or mostly-deterministic dependency resolution; semi-decent packaging systems like the ones you mention have lockfiles. Pre-uv Python packaging is uniquely awful.

What do you prefer for lockfiles in the Java world? I’ve been trying to drag a couple of Maven teams into the 2010s after finding that they weren’t.

You don't need them. Maven has deterministic dependency resolution (unless you use version ranges, but don't do that), so you just write your dependencies. (The flipside is you may want to get in the habit of doing something like versions:use-latest-releases as a regular housekeeping task so that you pick up any security updates, but that tends to be less of an issue in Java-land for other reasons)

Why don’t I need them? I can’t make every third-party package do exact version pins and it’d be miserable if I could because then I couldn’t patch a transitive dependency faster than the upstream even if there’s a drop-in patch release which is 100% compatible.

Even if that worked, I’d also want hashes to avoid file modification, although that’s less of a concern for anything on Maven Central where the releases are immutable.

> I can’t make every third-party package do exact version pins

Every third-party package already uses exact version dependencies, you don't need to do anything.

> then I couldn’t patch a transitive dependency faster than the upstream even if there’s a drop-in patch release which is 100% compatible.

You can always override the transitive dependency version if you want to.

> I’d also want hashes to avoid file modification, although that’s less of a concern for anything on Maven Central where the releases are immutable.

It's not just Maven Central, there's a strong norm of releases being immutable everywhere. If you're worried about attacks, there's a plugin you can enable to check the GPG signatures.

Depends on exactly how the project is managed. Older python tooling (`pip` module) doesn't have a native mechanism to differentiate between the spec (direct dependencies) and freeze (all dependencies, including transitive).

Yes in principle. From my experience, Python libraries just love breaking compatibility with the flimsiest of reasons.

It was written in older version of PySimpleGUI -- it just stopped working! Pretty annoying.

You didn't have a lockfile? Or a commit date you could use with --exclude-newer?

I switched to Freesimplegui as a replacement.

Reply on news.ycombinator.com