All right, sorry I didn't get it (I'm non native)
935 karma · joined November 18, 2018
Again, it's all a question of point of view, what we see as a package manager problem and causes us to keep reinventing packages managers, might actually be a problem with how we maintain our packages, my point of view being the latter. But I'm digressing.
When it comes to installing on "another machine", you don't know what Python they have, you don't know what libc they have, and so on, that is exactly what containers attempt to mitigate, so that seems exactly like the tool to use for this problem.
Exactly, because the packages were created/updated at a point in time were they were compatible: a distro ships python 3.x with packages of python modules that are compatible with python 3.x.
Now if you as a user want to use a python package that works with python 3.y, you either have to wait, or install python 3.y, or use a container of python 3.y.
Again, if all python package were up to date as in "working together at this point in time" then `pip upgrade` would work.
> Also, distro package managers keep track of everything installed, while python ones (at least pip I'm 100% sure) don't.
Are you sure you checked in the `*.dist-info` directories? There should be one per package, containing: a METADATA file, with all dependency versions, a RECORD file, with every installed file and their hash, and much more! see for yourself ;)
> You could install a package which upgrades another one, and that breaks another that you had installed before and pip won't say a word.
Let's agree to disagree right there:
- in your point of view: this is a problem in pip
- in my point of view: this is a maintenance problem in the python packages themselves, caused by the general practice of pinning
This sacrifies time and disk space and hides tech debt under the carpet, I'd rather have a solution like `pip upgrade` that would upgrade all packages and fix the environment, like `pacman -Syu`, but people would have to stop pinning versions and actually maintain their codebases and the dependencies they uses.
In this case, it doesn't matter to me which dependency update broke it, what matters to me is to have the tests passing again with all dependencies.
> I don't agree that using an outdated package is necessarily a problem at all. Some versions are done!
If a version is done then why is there a new release? Using old versions is tech debt that will one day blow up and cost much more to correct than if it had been corrected over the time, not to mention the security risk.
> You don't necessarily need to update _ever_
Another dependency might decide to use that dependency in a newer version, in which case aren't we all better off using the latest versions of everything? The cost is some effort, the benefit is more features, security, performance, less bugs, basically a better program.
> There will also be vulnerabilities in new packages though, which may be unknown, and will often not exist in older much simpler versions.
Then why upgrade at all when you have a dependency with a security issue? After all, in your upgrade you might be adding even more unknown security issues that might be even more dangerous.
> Using a well-tested version of a dependency that does exactly what you need is not less secure than chasing the latest version at all times without a specific reason.
If I can test well that a newer version of a dependency works for me, why not upgrade it? There might be performance, security or other bugfixes, and I'm allowing other maintainers of other dependencies to also use that newer version.
> I rather see more software go in this direction, valuing reproducibility & known correctness (i.e. with isolated pinned dependencies, in some form) over 'always be latest' dependency updates and the complex & hard to reproduce bugs that those shifting dependency interactions can create.
Ok, but then again, some version might fix a security bug that has not been backported to your old version, especially if it's 5 years old.
Basically you're advocating against continuous integration (I'm talking about the "practice", not talking about "the tool that runs automated tests that people call CI").
Tip: in such situations I start looking at the CI scripts in their repositories. Not ideal but gets me through!
https://github.com/openstack/pbr https://github.com/codrsquad/setupmeta
However, installing every dependency in the same environment is also what distro package managers do, I don't see that as a recipe for disaster, it all depends how well the said packages are maintained in which case just upgrading them should fix whatever problem.
That is the real problem IMHO. Most python users like to pin dependencies so that "their program don't break", and that's also the reason why so much effort is put in what they call "correct" dependency resolution resulting in the creation of new python package managers that all do "more correct" dependency resolution and make programs "break less" and at the same time require less efforts from the maintainers to actually maintain their code by doing dependency upgrades. And then one day you want to upgrade a dependency and you realize you're 10 releases behind on 10 dependencies, and what was supposed to be a quick maintenance task is now 100 maintenance task.
If you don't pin, your program will break one day or another, a user might open an issue with the traceback, or, your program will break directly in CI where you will see the traceback. Upgrade it, or contribute to the dependency, but just go ahead and fix it, instead of being defensive and trying to have dependency resolution that "doesn't break". At the same time you'll be adopting the actual practice of "Continuous Integration", of your dependencies, which has a better cost/benefit ratio.
I always avoid pinning dependencies, I try to make pip just install the latest version of everything, I am willing to contribute upgrade fixes to any Python package I use, but some dependencies do pin which breaks my own aggressive Continuous Integration practice, heck, I'd even need an option for pip to ignore version resolution at all so that I can make all my contributions to upgrade everything I use. I even remember when I had CI test matrix with all combinations of versions of everything, I don't do that anymore, I just support the latest of everything, we can always have the latest python with containers anyway so that's not even a blocker anymore. If you're not a "techbro using containers", it'd be fine too because you should then be able to make your distro packages at any point in time and expect all of them to work together, minus the delta of the handful of upgrades that are pending to release here and there.
Right, but then just use pip install --user instead of a virtualenv. Actually --user is the default now when running pip install from non-root user, so, just pip install as a user will work and not mess with the system packages, just don't do sudo pip install.
Why merge into mainline immediately, doesn't their pipeline deploy on branchname.ci.example.com or something? Like in GitLab review deployments with k8s or other eXtreme DevOps practices.
France recently removed wealth tax, because it's too easy to fraud and just made it harder for wealthy people to spend their money in France. I suppose the experience will be the same in the US.
I would be interested in any source you have to back this up because I was seeing rather the opposite ...
He's facing the crowd of actually masked protesters, surveilling them which is probably why he got caught, they completely outnumber him, which makes me thinks it's probably better for his defense to hold a rock in his hands.
I mean, look at this crowd of masked people, some even wearing gasmasks, holding red flags, with god knows what in their backpacks, claiming that the infiltrated agents are there to "provoke them", what a joke of bad faith.
You don't want them to do that? Letting them do more preventive surveillance would be a solution then, that'd be an upgrade for everyone. But you don't want that either so I guess we're stuck in this status quo.
It's actually in the video you posted so I've seen it. They were there with masks, they were not protesting, but they were standing peacefully: that is what I see in the video.
> The Canadian police got caught out trying to incite things
That's why I was talking about the "rock in their hands" part of the story because that's the only part that would be valuable at all to support the claim that they were there to "incite".
But actually you're probably wondering about the reason why they are dressed like other violent protesters (which we can see in an earlier part of the video in another street), there's a reason for that, and it's pretty simple: it makes it easier to catch them. And when you do you're burned so it's not like the costume is going to last forever.
Why did they then go to the peaceful street then? Because they were expecting the violent protesters from the other street to refuge there and take off their masks and blend in with the peaceful protesters. By being there first they could have caught them, but the "peaceful protestors" who "caught them" didn't let them do their job.
I don't believe one second that they did that to incite things, that they would be throwing rocks at their own colleagues, and have seen absolutely no reason let alone any evidence to think otherwise.
But even if their presence did incite you, then you would get caught extremely fast, and that would probably be a better ending for everybody including yourself, before you become a bigger danger.
Canada: A "filmmaker" claims that one of the police officers had a rock in their hand, why would I believe a "documentary filmmaker" without any actual evidence (you'd expect a video evidence from the guy) participating in a protest more than actual police officers? or than the minister of public safety? or than the journalist who obviously could not verify it and as such did no mention it?
There's only one logical reason that comes to my mind: because you want to, like the person who choose the title "Canadian Undercover Police Officers Caught Trying to Start a Riot", that's not an honest title, "Canadian Filmmaker Pretends Police Officers Tried to Start a Riot" would have been actually honest. Who's manipulating who now?
Nice description under the video too, but it's only one side of the story: we also hold tons of evidence that people actually lie and plan to lie just to cause agitation, protests and so on. Is that something that you would be interested in as well? Or are you just interested in "anything against the elected government"?
You're still daydreaming about civil war, maybe that's why you're so scared of your own ethics?
> With regards to AML: You can't tell if you're making progress if you don't have all the pieces.
Yes, I can tell there are many competent people working daily on the AML problems, more tech is created, more laws are created, more offenders get caught: and I dare call that "making progress".
It's actually a striving sector because financial institutions such as banks get fined for when they don't try their best and that itself creates a lot of budget to make even more progress.
> Your last paragraph is nonsense and your using it to justify your own identity. Your last sentence terrifies me. It means you have no idea whats going on either and have sold out or bought in to something you don't completely understand.
Absolutely, you're part of the little number of people who are aware and know, and I'm part of the majority of ignorant people. Nice argumentation by the way! (jk, you're just meaninglessly trying to maintain the status quo).
There's also the communist party, well I guess that's over now you're absolutely free to be communist, same goes for feminism.
And the groups in question have all won, their ideologies have won, you know have blacks, muslims, feminists, communists inside probably every government agency - even though, they will probably not be extremists, and love their country.
If these ideologies have won, and that freedom has stabilized for everyone, what's the point of going into yet another civil war now? If you agree it's pointless, then why are you afraid that the government would go after you if you are not dangerous?
You're saying the ethics of individual operators are irrelevant, does that mean you think that the ethic of Minutemen was irrelevant? It's half the story from my point of view, even you are criticizing their ethics ("trying to coerce into committing crimes").
Psychological warfare goes both ways you know, for a government to try to counter it seems pretty sane to me. It's not like you're not free nor have many means to publish all the agitation propaganda you want these days.
But we get it, you just want to keep your tech to overthrow elected governments instead helping the government to protect your family and people, because "solutions can create more problems than they solve": let's not do anything about our security problems and let's especially not try more tech nor tech upgrades.
I also love to read this kind of parallel between fiction and reality. However, when you have some experience working in defense you find out reality is more like: there's real criminal to catch, real victims to protect and to save, it's not like we have any time for non critical stuff such as going after pacific dissidents, and controlling all the medias like in V would be so much work and pointless it's not even considered.
About Exxon, well international finance is particularly hard indeed which you'll find out quite fast you start working in the AML sector, but guess what we* are making progress. But let's face it as scientists: there will be no silver bullet. All we have left is to compare cost/benefit ratios of different compromises. As such, you will always find a single case of something to complain about on some tech forum if that's what you get your kicks from.
*we: people who are actively working on it rather than complaining anonymously about single cases and making generalities about it in order to propagate some agitation on some obscure tech forum to predict a future like in a teenager comic book
It's funny here, users complain about Exxon and others having unethical behaviors or even breaking the law, I relate to that, but at the same time they are against using tech they create to increase security. How do you live in such a contradiction? Not to mention mass surveillance will create tech jobs you are probably part of the small number of people who can apply and get hired and actually work on it with their own ethic.
Reality is: people want more security, that's part of their expectations from paying taxes, mass surveillance offers just that.
They want to choose a doctor instead of choosing their treatment, unlike you, they don't fantasize on being aware of every aspect of all politics, going to vote every day on every amendment, they just want professionals to do their job just like they do theirs, they accept that these can make mistakes, or not do exactly what they would have because yes, they have their job and their families - which, you know, is two jobs already - to take care of rather than "they prefer to spend their days at the beach".
Exactly, and all you need is Any
> a lot of people out there are writing code this way: just hack away until it works, and fix it if it ever crashes.
I'm willing to agree that Non-TDD hackers should go for static typing.
I hope this won't be your case, living in fear with your children for a year is a bad experience, not to mention the hospital and sequels. I wish "hope" was more that we could do, this new security systems are an answer.
If you don't thrust your government with this, perhaps you should apply to work on it in defense - surely, this will create quite some tech jobs - so that you be in charge. Actually, if you have experience working in defense, you might already know that there's plenty of work catching criminals, there's definitely no time for anything less critical, despite whatever grounds you build fear of dystopia on.
We are not in a George Orwell dystopia but actually have real lives to save and really dangerous criminals to stop despite what you may think. And I'm really glad that you live in a place where you feel safe and I hope this stays this way, and I'm really happy for you that you have not lost a child to criminality, or a friend to terrorism, but keep in mind it's not the case of everyone.
We can't all be like famous french leftist Mathieu Kassovitz and look at a mother in the eyes and tell her that the event of the death of her child is just "a miscellaneous event" and that there's nothing to do about it, that's it's the way it's supposed to be. I mean, go ahead and be my guest, explain to her that mass surveillance will put her into more danger than not. Her dystopia is probably very different than yours, and much more real. I'm sorry, but I'm siding with the victims here, from CP to whatever.
If we can save even just 1 child, shouldn't we because you are scared that a government employee would be reading your flirts? I don't understand how you people not only can just be against more security, but also willing to sacrifice children to protect your "privacy" (flirts, dickpics) which nobody working in defense actually gives a flying f** about.
And Patrick Breyer, if you're reading me, next time you want to make an argument about "minors sexting", I would suggest you find a way that does not make you look like a pervert who wants to keep it easy for minors to send him nudes, cause it kind of looks like that from where I'm standing.
What kind of congressman in their sane mind would vote against this? None. Does that mean it is perfect? No, but it's a start, and I believe we will improve from our mistakes, we have to start somewhere. This is the start of new era of security, which many of us pay taxes for, we deserve this, and hopefully it's not some "pirate party", or "pedo party", or "criminal party", or "human rights defender party" who is going to stop us from getting there.
Or, they are referring to the IPCC reports themselves, for sure, the third and last working group who has the final words are not scientists indeed, which leads to all these "mistakes" in every final report that our politicians use (or try to) to create new taxes on the poor.