lime

i'm interested in the dynamic linking, what mechanism is used to stop situations like left-pad or the pypi incident where a file is removed replaced with a malicious alternative?

i'm completely unmotivated at work and my tasks are time-sensitive. also my employer is collapsing around me so i'm trying to see if anyone else needs people.

also i'm halfway through a move, and there's no internet in the new place until december so i'm sitting here in a room without curtains and full of boxes, the only thing still unpacked being my remote work setup.

i mean, that is the difference between interpreted and compiled.

if the container doesn't work though, that means it is broken and should be fixed. the point of them is literally to be plug-n-play. that would be like distributing a go binary with a segfault in main.

if I'm reading this right, it's a bit like ipfs+dht. is this a content-addressable system?

anyway, you should probably have demos of

• large files (like a Linux disk image), to demonstrate consistency in transfer.
• Video stream, to demonstrate performance and low latency.
• multiple files shared with many peers at once, to demonstrate scalability
• sharing with low bandwidth and high latency, to demonstrate possible mobile use cases.

thoughts:

• the logo is very close to wireguard's.
• if the data is stored on peers, that means there must always be people with free storage online for it to work? how much storage is needed? is that data in plaintext? could a bad actor push illegal content to peers without them knowing?

also, please convert the whitepaper to a format that is actually readable. rtf? really?

that's posturing if anything. if you're an experienced developer it takes fully 10 minutes with either system. and if you're not interested in modifying it, just use a container image.

the only case where i would agree with you is when i have to modify LD_LIBRARY_PATH to get things to run...

a full-face veil.

such a strange interpretation. i've been working in go for over 10 years now, and i love it. but the notion that you can "just find the same program but built in a different language" doesn't make sense at all.

like, if you're annoyed with pandoc being written in haskell and clogging up your system dependencies, you can't just "find another pandoc". there's nothing like it. same thing with curl, or xonsh, or thingsboard.

such a weird take.

it's not though. op has issues installing programs built in python. suggesting they rebuild those programs in go is 100% an apples to meatballs comparison, and way off topic.

this is not about offense! nobody is offended. but if you ask me for help with an apple pie and i tell you to make meatballs... it's a confusing lack of relevance.

everyone focuses on the tooling, not many are focusing on the reason: python is extremely dynamic. like, magic dynamic you can modify a module halfway through an import, you can replace class attributes and automatically propagate to instances, you can decompile the bytecode while it's running.

combine this with the fact that it's installed by default and used basically everywhere and you get an environment that needs to be carefully managed for the sake of the system.

js has this packaging system down pat, but it has the advantage that it got mainstream in a sandboxed isolated environment before it started leaking out into the system. python was in there from the beginning, and every change breaks someone's workflow.

the closest language to look at for packaging is probably lua, which has similar issues. however since lua is usually not a standalone application platform it's not a big deal there.

it's also not at all relevant. go is great, but this is about python.