Hacker News Reader

Comment by canadiantim | Hacker News Reader

Pyodide examples using urllib3 in browser still requires using fetch, so this still requires javascript.

What does this practically mean?

Does this ever point to a future where we can use urlib3 instead of fetch?

Lead maintainer of urllib3 here: We're tracking all the options for how we can make the experience better for folks looking to use Python in the browser. Today our biggest blocker is that there's no socket or TLS APIs for Emscripten/WASI. If those were to become available we'd jump on them right away :)

I think the biggest benefit of a foundational project like urllib3 getting browser support is that /many/ Python projects are built on top of urllib3 and many of them likely work in browsers now that urllib3 works in the browser.

For example, Requests is built on top of urllib3 and now gets browser support for free! And this is recursive, how many projects use Requests (spoiler: many). Pretty exciting IMO :)

wow that's awesome. That we could even talk about potentially using just python to make requests in browser is pretty wild (of course, as you say still blocks in the way - lack of socket or TLS APIs for Emscripten/WASI). Really cool stuff tho. All the best eh and thank you VERY much for the incredible urllib3 library.

Do you know if there are some plans for sockets or TLS APIs or are we far away from this?

Browsers limit the ability for these platforms to use raw sockets, there simply is no API for it. The best that can be done /today/ is to use WebSockets, which are not the same thing and can't be used for HTTP requests without the server expecting a WebSocket connection:

https://github.com/emscripten-core/emscripten/issues/5196#is...

Sure, sorry if it wasn't clear from my question, it wasn't specifically about urllib3, but I meant if there are plans that browsers will make such an API available or if this is something that will never become real.

I doubt browsers would allow this, though gamedevs have wanted it for decades now. Particularly UDP.

isn't the udp problem fixed with http3 unreliable webtransport?

Is it? That would be cool. Under the hood is it actual udp?

HTTP3 uses QUIC, it's not "pure" UDP, but it's a protocol based on it

https://en.wikipedia.org/wiki/QUIC

its udp with encryption and congestion control, but the aspects that gamedevs like about udp, low latency and out of order delivery without head of line blocking are features

https://developer.chrome.com/docs/capabilities/web-apis/webt...

Thank you for your work on urllib3; I will probably never use Requests if I can help it. I'm glad that you're keeping up that "batteries included" tradition.

except the browser context is being sandboxed with lots of access restriction, individual profiling, geolocation reporting, device identification, and more

Big Tech does not like independent protocol operation it seems; therefore your interesting technical advance is likely to be a pawn in other, larger changes to the social contracts on the open net IMHO

Am I misunderstanding this? You need JS to load the WASM module anyways, what does "requiring JS" means here?

It means that urllib3 (python code) isn't actually making the http request (it's not making the tcp connection, tls auth, writing the request, or serializing the request headers ...)

It may be better to describe this as a "shim". Any python code that depended on urllib3 is now transparently shimmed in browser context to use the fetch-api instead. Which is useful.

This is definitely out of scope for web browsers. The security implications of allowing arbitrary sockets are prohibitive.

To do something like that then you’re going to need a different environment with a different set of security guarantees and expectations, more like a shell where the user is responsible for vouching for the code’s trustworthiness.

You’re right. It just reflected a momentary misunderstanding of mine. WASM still requires JS.

Reply on news.ycombinator.com