Hypermodern Python

Re:Hypermodern Python by cs702 on Thursday May 28, 2020 @09:16AM (#23336855)

It's evident from reading the OP and previous similar posts on HN that many developers find it difficult to specify and replicate deterministic Python environments for their applications. Personally, I have found it best to use (a) a virtualenv or conda environment, with (b) a requirements file that specifies fixed version numbers for packages (e.g., `pandas==1.0.3`). Only very rarely have I run into issues doing this; it works quite well for me.

That said, from a security standpoint, I'm not sure it's a good idea to run a script downloaded from the web, without verification, on your local command line:

  curl https://pyenv.run | bash

If that URL ever gets hijacked, you would be running malicious code. At a minimum, you may want to take a look at the script before running it, or otherwise verify that you're downloading what you actually want to run.

[ Parent | on HN ]

Re:Hypermodern Python by tyrion on Thursday May 28, 2020 @09:51AM (#23337210)

I completely agree. I have no idea why many people seem to be fan of this `curl x | bash` approach.

For pyenv all is needed is to clone their git repository and add a couple of lines to your .bashrc.

[ Parent | on HN ]

Re:Hypermodern Python by dahfizz on Thursday May 28, 2020 @10:05AM (#23337345)

I think `curl | bash` is treated unfairly. Whether you `git clone` or `curl` a script, you are fundamentally doing the same thing: downloading and executing code from the internet. `git clone` just feels safer because it is hiding that fact under layers of abstraction.

If I want to run pip, I need to trust PYPA. It's their code I want to run, and I need to download it one way or another. If I don't trust them to keep their domain secure, I don't see why I would trust them to keep their github repo secure.

And the whole point of pip is to download code from PYPI and run it. pip, git, curl|bash, all do the same exact thing in this case. curl|bash just smells funny because it makes it more plainly obvious what is going on.

[ Parent | on HN ]

Re:Hypermodern Python by dtech on Thursday May 28, 2020 @10:31AM (#23337717)

git clone will not execute arbitrary code from the internet without inspection.

[ Parent | on HN ]

Re:Hypermodern Python by hagy on Thursday May 28, 2020 @10:54AM (#23337987)

I assume the cloned git repo includes arbitrary code that will be executed with the same security profile as a downloaded shell script.

[ Parent | on HN ]

Re:Hypermodern Python by dahfizz on Thursday May 28, 2020 @12:07PM (#23338912)

If you read the source of all the programs you run, more power to you. Most people don't.

[ Parent | on HN ]

Re:Hypermodern Python by BiteCode_dev on Thursday May 28, 2020 @10:03AM (#23337328)

Honestly, the best approach should be "sudo apt get pyenv", but it's such a pain to package a program as a deb I undertand many people don't bother.

Beside, curl works on all linux AND on mac.

Saves time.

[ Parent | on HN ]

Re:Hypermodern Python by jzzskijj on Thursday May 28, 2020 @10:02AM (#23337313)

Exactly. The WHOIS information of pyenv.run doesn't reveal anything who is controlling the domain.

And the "more information" link https://raw.githubusercontent.com/pyenv/pyenv-installer in that script points to "400: Invalid request" result.

[ Parent | on HN ]

Re:Hypermodern Python by hojijoji on Thursday May 28, 2020 @09:51AM (#23337209)

Don't you get a bunch of incompatible packages when you restrict to specific fixed version numbers without indication? I guess this is only helpful if you don't plan to reuse your code in another project.

[ Parent | on HN ]

Re:Hypermodern Python by cs702 on Thursday May 28, 2020 @10:46AM (#23337911)

Good question. The approach I proposed works for production applications that require an easy-to-replicate, deterministic environment, but I wouldn't recommend it if you're trying to build, say, Python packages or frameworks meant to be used in diverse environments.

[ Parent | on HN ]

Re:Hypermodern Python by thefunnyman on Thursday May 28, 2020 @11:37PM (#23346044)

Perhaps this is just my own inexperience showing but I haven’t ever had an issue using venv (which is included in python3 now) and a requirements.txt file.

[ Parent | on HN ]