cqqxo4zV46cp

I frankly don’t give a fuck about PyPA at this point. They’ve proven themselves to be largely irrelevant in this context. Anything they get their hands on just seems to rot, so I’d unfortunately like them to stay far away from this. It pains me to say this. It’s against my philosophy. But it’s merely a reflection of the current state of things. I’ve been working with Python full-time for a decade. Other packaging ecosystems have essentially lapped Python’s.

At this point I also don’t care about nuances like “is it execution issues with PyPA, or that their set remit is faulty?” I’m sick of getting drawn into that stuff, too.

Nobody is saying that they shouldn’t continue using it?

Python is slow compared to Rust, obviously. Beyond that, pip is at this point carrying a bunch of legacy decisions because the ludicrously large number of hard left turns the Python packaging ecosystem has taken over the last 20 years.

Home Assistant is an absolute behemoth of a project, especially with regard to dependencies. Dependency resolution across a project of that size is nuts. There are probably few currently projects that’d see as big an improvement aa HA.

The PSF and PyPA are more than welcome to get their act together and tell a good packaging story for Python. Unfortunately all they’ve had to offer is a billion contributor blog posts essentially saying “the system we set up for ourselves limits our ability to be helpful, and that’s not our fault, somehow.”

They’re all so caught up in their internal systems and politics[1] that they don’t seem to know why they’re actually there anymore.

So if someone’s gonna go do an actually-good job and capture the market in the way that Astral is, then that’s exactly what we as a community deserve.

[1]: I mean internal politics. This is a weird alt right “DEI HIRE!” rant.

“It’s the corporations, mahn!”

I’m sure that you can piece together how this could happen.

My first employer as a developer, due to their incompetence, not intelligence, ‘let’ me break our customers’ shit from a young age. As I’ve progressed through my career, and through my transition to leadership, I’ve realised that it was a very valuable experience. I may have stressed about it in the past, but those memories are too distant for me to even reach now. I certainly don’t stress about it now.

I’ll, maybe controversially, sometimes allow my (early-career) team members to break prod, if I can see it happening ahead of time, but am confident that we’ll be able to recover quickly. It’s common knowledge that being given room to fail is important. But many leaders draw the line at failures that actually hit customers. If one finds oneself in the very common and very fortunate position to be building software that isn’t in charge of landing planes or anything similarly important, they should definitely let their team experience prod failures, even if it’s at the expense of so-and-so from Spokane Washington not being able to use their product for a few minutes.

I’m sure there are 50 other ways you could categorise all the code that it searches. Nobody said that it exhaustively searches all available open-source code. I’m sure you know that that’s an impossible claim. This isn’t a correction at all. It is, at best, an elaboration. Certainly not worthy of the snark you’re giving. The reality is that GitHub hosts >99% of all open-source source code that anyone really cares about. If you have some philosophical issue with it, that’s fine, but don’t shoot the messenger by attacking individuals.

Classic. People that are bad at UX design using the “pro app” catch-all to justify all sorts of bad decisions.

I spend all day in “pro apps”. I am also visually impaired. The inappropriateness of toasts has nothing to do with my familiarity with the app. I may, eventually, learn that a particular UI is using toasts to indicate something. That doesn’t suddenly make it okay. They’re still a massive pain in the ass for me. They’re still a massive pain in the ass for a lot of people. They’re still a poorly thought out holdover from the days of 640x480 displays, and with a modern resolution they’re even less appropriate.

Last I checked, HN isn’t OPs personal army, as it were. I’m sure that the replier is aware of what was being asked, and what they were responding with. To suggest otherwise is condescending.

This is a social network. This sort of conversion is not just allowed, but encouraged. Perhaps you’d feel more at home on a Stack Exchange website, where like-minded individuals will stand alongside you in enforcing a strict Q&A format, even when it doesn’t make sense to.

Yep. There’s certainly a balance to strike, especially on projects with a larger number of people working on them. But I generally find that you want to do at least MOST of your data processing outside of your template.

I’m not sure what the point of this is other than a nerd flex?

Okay. So now you, individually, may be able to attribute some sort of responsibility in some sort of civil action.

Penalties that companies care about aren’t going to be built around some very non-standard individual’s ability to maybe, sometimes, attribute blame.

Plus, the real damaging stuff wont have anything to do with your email addresses.

I don’t know if there are just too many kids around or if everyone has a short memory, but Eric Schmidt was in his heyday know. for awkwardly sticking his foot in it with tactless comments like this.

Yes. Sure. But the reason this is on HN (for the millionth time) is because Eric said it, and Google bad, or whatever.

What? Have you ever hired before? This sounds exactly like the unrealistically simple view of someone that’s never been in this position before.

You thought people were never supposed to answer that question? Well, they do. Especially developers, who are more introverted than average, on average, and are easy to catch off guard.

I have a budget, sure. Unless your corporate setup is one that especially takes all power away from hiring managers, it’s almost always more complex than that. Maybe I could move some money around to free more budget up. Maybe someone on my team is a retention risk and I need to weigh up priorities. Maybe a billion billion other things.

Your personal budget, no matter how implicit or explicit it is, almost certainly isn’t this simple so I have no idea why anyone thinks it works this way at work. Any organisation that is that simple and rigid isn’t capable of rolling with the punches, and isn’t somewhere anyone should want to work.

That’s not remotely the point.

Classic “engineers pretend to understand the law” logic.

What does “works to improve” mean. It’s like you wanted to shoehorn the US in here.

You … could have both things. You could have real consumer protections, so people like you don’t conflate competition with an absolute free-for-all.

Plenty of other jurisdictions do it.

Some people trivialise things in bad faith to score internet points on Hacker News, I guess. The status quo, per the article, was already using “deep learning” models to perform anomaly detection. We are already talking about complex, black-box systems.

The stated advantage was that they didn’t require deployment-specific training. You can just throw a pre-trained LLM at it. There is also a stated benefit: early-stage detection, without needing to pay for, or wait for, training a custom ML model. The article is quite open about the fact that the LLM approach doesn’t beat the state of the art in terms of accuracy.

It’s like you didn’t click the link.

The easiest people to advertise to are HN knowitalls that consider themselves infallible, completely logical beings.

Advertising works on you. You’re just, at best, describing a scenario where you aren’t being advertised things that you currently find appealing.

You’re currently on a social network that’s basically just YC’s advertising board.

Django got hit with an SQL injection vulnerability just the other day. I basically fell out of my chair when I saw it.

Using the internet in 2024 without JS, and commenting on things not working, is borderline delusional behaviour.

What “the US” did 50+ years ago has absolutely no say in what “the US” can do now.

That feels like a slightly different can of worms, though.

Yeah. It’s completely unambiguously slimy. As a result, I feel absolutely zero connection with the author. Guessing that wasn’t the intention.

You sound like a very aggressive person. I don’t think I’d like to work with you regardless of whether or not you were right. Maybe you’d get your point across better if you weren’t so aggressive about it.

Most IT departments wouldn’t have seen this coming, and certainly would’ve been right to not base their entire security strategy around it. I’m not sure where this narrative is coming from. Falcon delivered and still delivers real, genuine security benefit to its customers. That does not mean that it eliminates all risk, and does not mean that it doesn’t introduce risk of its own.

It’s literally a game of trafeoffs like all engineering problems. This shouldn’t be that foreign to anyone here. Suddenly HN is full of security experts that are fuelled with 20/20 hindsight and recency bias, explaining how companies could’ve dodged this bullet without considering what very real bullets were being dodged by using Falcon in the first place.

Oh Christ. Just drop it. A by all accounts legitimate security function of a product targeted at company-owned endpoints.

Please don’t devolve this conversation into you being upset about not getting admin rights on your work computer or whatever this is about.

Any (esp. larger) org would be criminally negligent to eschew using something like CrowdStrike in order to capitulate to some nerd that thinks that they have ownership over their work equipment.

Genuinely, what good does that do?

It’s all well and good to write dramatic meaningless comments on social networks like Hacker News, but if your desired had actual consequence, can you honestly say that “nuking the company” is a net positive?