Sorry Python but it is what it is.
this post was submitted on 13 Oct 2023
304 points (80.8% liked)
Programmer Humor
32596 readers
488 users here now
Post funny things about programming here! (Or just rant about your favourite programming language.)
Rules:
- Posts must be relevant to programming, programmers, or computer science.
- No NSFW content.
- Jokes must be in good taste. No hate speech, bigotry, etc.
founded 5 years ago
MODERATORS
npm is objectively worse. Base pip packages aren't getting hijacked.
Maybe I’m misremembering, but didn’t pip have it’s own security concerns earlier this year?
I believe that was just name squatting.
It’s less the name squatting and more pip not supporting a certain PyPI resolution order: https://github.com/pypa/pip/issues/8606
For example, I have A, B and C in my requirements.txt but I want to install C from my own private PyPI. Everything works fine until someone uploads a package name C to the public PyPI then suddenly I’m not installing my private package anymore.
load more comments
(1 replies)
That's not a controversial opinion. I'd say it's worse than pip. At least pip doesn't put nag messages on the console or fill up your hard drive with half a gigabyte of small files. OP is confused.
npm is so good there are at least 3 alternatives and every package instructs on using a different one.
load more comments
(1 replies)
load more comments
(18 replies)
So you are saying that npm is better than pip?? I'm not saying pip is good, but npm?
npm has a lockfile which makes it infinitely better.
pip also has lock files
pip freeze > requirements.txt
Would that just create a list of the current packages/versions without actually locking anything?
Would that just create a list of the current packages/versions
Yes, and all downstream dependencies
without actually locking anything?
What do you mean? Nothing stops someone from manually installing an npm package that differs from package-lock.json - this behaves the same. If you pip install -r requirements.txt it installs the exact versions specified by the package maintainer, just like npm install the only difference is python requires you to specify the "lock file" instead of implicitly reading one from the CWD
load more comments
(4 replies)
load more comments
(5 replies)
load more comments
(3 replies)
load more comments
(2 replies)
NPM is ghastly though
npm is just plain up terrible. never worked for me first try without doing weird stuff
I don't know what cargo is, but npm is the second worst package manager I've ever used after nuget.
cargo is the package manager for the Rust language
I've never had an issue with nuget, at least since dotnet core. My experience has it far ahead of npm and pip
I'll second this. I would argue that .Net Core's package/dependency management in general is way better than Python or JavaScript. Typically it just works and when it doesn't it's not too difficult to fix.
load more comments
(1 replies)
load more comments
(5 replies)
Memes like this make me ever more confused about my own software work flow. I'm in engineering so you can already guess my coding classes were pretty surface level at least at my uni and CC
Conda is what I like to use for data science but I still barely understand how to maintain a package manager. Im lowkey a bot when it comes to using non-GUI programs and tbh that paradigm shift has been hard after 18 years of no CLI usage.
The memes are pretty educational though
Try not to learn too much from memes, they're mostly wrong. Conda is good, if you're looking for something more modern (for Python) I'd suggest Poetry
load more comments
(4 replies)
This is why I use poetry for python nowadays. Pip just feels like something ancient next to Cargo, Stack, Julia, npm, etc.
load more comments
(2 replies)
What about CPAN?
You can't even use it without the documentation of the program that you want to install because some dependencies have to be installed manually, and even then there's a chance of the installation not working because a unit test would fail.
the only time i've had issues with pip is when using it to install the xonsh shell, but that's not really pip's fault since that's a very niche case and i wouldn't expect any language's package manager to handle installing something so fundamental anyways.
load more comments
(1 replies)
No one here has yet complained about Cocoapods and Carthage? I'm traumatized. Thank God for SwiftPM
Getting into rust is still on my to-do list, otherwise I've no major problem with pip or npm. They both have their flaws, but both work well enough to do what I need them for. If I had to prefer one it would be pip simply to sustain my passionate hate for all things JavaScript.
load more comments
(2 replies)
view more: next ›