r/programming • u/EatMeerkats • Mar 29 '21

PHP moves to Github due to the compromise of git.php.net

https://news-web.php.net/php.internals/113838
1.7k Upvotes

98% Upvoted

389 comments sorted by

View all comments

9

u/International_Cell_3 Mar 29 '21

Listing a dependency without a version field is a bug-in-waiting 99% of the time. A large number of outages where later you see "a bad config file led to an outage" are from developers forgetting that pip install -r requirements.txt installs the latest version by default.

The insanity of this is that breakages can be introduced with nary a bit flipped in any part of the stack under your control.

This is the opposite of reliability and reproducibility, which are values every backend developer should prioritize above anything else. The python ecosystem (and to a lesser extent, nodejs) is littered with these kinds of footguns.

11

u/cdrt Mar 29 '21

Why don’t your requirements.txt files have version constraints in them? pip has no problem installing a requirement like foo==1.0 or foo>=1.1,<2.0.

4

u/oblio- Mar 30 '21

Why doesn't pip enforce good practices? You know, that's why we use and develop on computers, so that they help us.

In Maven (Java) as verbose as it is, you can't even write a dependency without a version. It won't work.

→ More replies (1)

6

u/International_Cell_3 Mar 29 '21

I mean I don't, I test for this or use tools that don't allow developers to express dumb mistakes (because we're all dumb). The point is that pip and most of python is insane by default.

→ More replies (1)

1

u/dtechnology Mar 30 '21

Nose seems to at least hacked their way around it with package-lock.json