u/SeniorScienceOfficer

Came here to say this lol

Nowhere in PEP 508 or 440 does it indicate that the list of dependency versions for a given project are to indicate compatibility over security. PEP 508 states:

The job of the dependency is to enable tools like pip to find the right package to install.

The “right” package is wholly dependent on the maintainer, the project, and what both consider to be “right” in their particular case. The only mention of compatibility is the Compatible Release clause of version specification (~=).

Do not confuse definition with convention. It has historically been the convention to use dependency versioning semantics for compatibility, but there is absolutely nothing indicating it can’t be used for security.

Version ranges for libraries are meant to be used for compatibility, not for security vulnerabilities.

This is a false dichotomy. In reality, it can be used for both. It is wholly dependent on the library/package maintainers desires. Which then boils down to how well of a steward the maintainer wants to be.

If every library applied this strategy the result would be mass-toil both for users and maintainers.

This is a “slippery slope” logical fallacy, going from talking about a single library to EVERY library. Just because the potential for downstream burden is real, doesn’t prove that the practice itself is wrong. It’s just highlights that the policy has scaling costs, which is an entirely separate question from whether or not a dependency floor is acceptable.

Realistically, this all needs to be taken on a case-by-case basis, and trying to apply this writ large to the Python ecosystem as an aggregate is a REALLY flimsy argument. Your argument also frames that using a higher compatibility floor is a “disallowing installing vulnerable dependencies” as if the library maintainer is responsible for all users’ security, but in practice it’s a “our supported minimum for this library should exclude vulnerabilities.” Which is a very common and significantly more defensible than what you’re suggesting.

Lastly you’re kind of collapsing different kinds of responsibilities into a single bucket. While having a dependency on a vulnerable library version doesn’t constitute a vulnerability in your first party code, it does present a REAL supply chain attack vector that you’re advocating for maintainers to ignore.

How about instead of trying to force maintainers into or out of certain practices, let’s all just try and do what’s right for the communities that build up around these beloved libraries and applications.

Nah, that’s uh… that’s my uncle.

SHIIIIIT. I’m almost 38 and I STILL love sleeping like this lol

That’s what the “—complete-platform” argument is for: https://docs.pex-tool.org/buildingpex.html#complete-platform

You have to generate the JSON in accordance to the format outlined in the PEP, but I’ve used it to build a Linux pex on a Mac. So, it’s 100% possible.

Have you looked into Pex? They’re effectively zipapps that contain your source code and bundled dependencies. You only need a compatible interpreter on the host machine and they run like executables.

This boils my fucking blood. I didn’t spend 2 fucking deployments on a DDG conducting counter piracy operations for the US Navy to become FUCKING PIRATES.

Someone just bought a Glitter Pink one for his soon to be 3 year old daughter. Threw in the pastel handlebar streamers because the wife loves that shit.

To follow up, I commented on an adjacent post to this with a “guide” of how I set up vGPU: https://www.reddit.com/r/Proxmox/s/y2nE2ZX4EV

I’ve used this guide (https://wvthoog.nl/proxmox-vgpu-v3/) and set up a Docker container with the license server and have had excellent success using vGPU profiles with my Tesla P40s

Same. I’ve been a fan of Tom’s since he was fat and single, but I haven’t seen or heard anything of the sort. The closest I got was some YMH podcast a while back with Andrew Tate before Tate became huge in the cesspool that is the Manosphere. However, watching that episode it really seemed like Tom was more egging him on to make fun of him to his face rather that agreeing with the likes of Tate. His wife is a little more on the yeesh side with her ideals, but that’s not on Tom.

Rick Sanchez???

It’s not pretty smart. It’s really fucking stupid. Not only is it illegal, it’s bordering on a war crime. There is no UN authorization and this is obviously NOT in self defense.

Infisical can provide something like Vault.

And this is why my internet goes through a firewall first.

Beltalowda

Get in mah belleh!

Slightly high and slightly hungry… damn you…

Definitely taking this

This near Hawtch-Hawtch? lol

Still working on my project called OrbitLab. Not ready to release the alpha version just yet, but here’s the repo for the curious: https://github.com/OrbitLab-OSS/OrbitLab

It’s built on top of Proxmox and aims to lower the bar for self-hosting various projects. It currently provides services like active/passive NFS, RDS-style database clusters using Patroni, and more. Still VERY much a WIP.

r/UnexpectedZoidberg

Thank you!

My thoughts exactly lol

Thank you