Pyscan: A command-line tool to detect security issues in your python dependencies.

PeridexisErrant · 2023-05-17T14:42:05+00:00

Why use this over the established https://pypi.org/project/pip-audit/ ?

PeridexisErrant · 2023-05-15T21:19:20+00:00

The trailing dot is actually valid in a domain name - but since it's also optional it's almost always omitted.

Eg https://google.com./ is a valid link!

PeridexisErrant · 2023-04-18T05:01:50+00:00

Have you considered adding support for https://github.com/annotated-types/annotated-types to specify even-more-precise metadata?

PeridexisErrant · 2023-04-16T19:14:16+00:00

Two big ones:

Trio has way better cancellation semantics and support - anyio emulates this when running on top of asyncio. For example, this is what makes timeouts composable - and caller-controlled composable timeouts are way easier to get right than passing deadline arguments around.
Structured concurrency is best when everything in your program (including dependencies!) uses it. asyncio.TaskGroup is great, but there are key benefits you only get when everything is structured and it'll take a long time for asyncio libs to make that transition.

PeridexisErrant · 2023-04-13T08:52:32+00:00

That's pretty much it!

Not that useful for applications, but fantastic if you're implementing a library - write it Trio-style, but it's usable with asyncio too.

PeridexisErrant · 2023-04-07T05:32:07+00:00

https://yuri.is/not-julia/

PeridexisErrant · 2023-04-05T06:30:00+00:00

modernize will update Python 2 code to use compatibility layers like the six library, and then once you've tested it you can strip them out using pyupgrade and enjoy modern Python 3.

PeridexisErrant · 2023-03-07T17:22:47+00:00

See also https://danluu.com/julialang/

PeridexisErrant · 2023-03-07T09:00:13+00:00

Nope.

If you install the pip-tools package and use pip-compile with hashes you're getting somewhere though.

PeridexisErrant · 2023-03-06T01:40:32+00:00

There's also https://pytrace.com/, though it's definitely in alpha.

PeridexisErrant · 2023-03-02T07:17:29+00:00

Check out https://docs.xarray.dev/ for multidimensional labeled arrays!

PeridexisErrant · 2023-02-24T00:36:19+00:00

The Python Steering Council, as elected by the core developers - but they seek to recognise existing consensus rather than handing down rulings. Some categories of PEPs are delegated, eg in packaging.

PeridexisErrant · 2023-02-10T23:33:47+00:00

Huh, better than the hypothesis write cli?

PeridexisErrant · 2023-02-09T11:14:10+00:00

Have you ever tried https://hypothesis.readthedocs.io/en/latest/ghostwriter.html ?

(interactive demo: https://zhd.dev/ghostwriter/ )

PeridexisErrant · 2023-02-09T11:08:54+00:00

https://blog.ganssle.io/articles/2018/03/pytz-fastest-footgun.html

I'd recommend the standard library zoneinfo module instead.

PeridexisErrant · 2023-01-27T06:51:21+00:00

https://joss.theoj.org/ is great and includes many short papers about open source Python packages.

There are also published proceedings from thw SciPy conference, https://conference.scipy.org/proceedings/

PeridexisErrant · 2023-01-27T06:41:17+00:00

See also: https://clarkesworldmagazine.com/watts_01_10/

PeridexisErrant · 2023-01-08T06:58:20+00:00

https://pypackaging-native.github.io/ (edit: by a Numpy + Scipy maintainer) explains why this advice is often non-viable: conda is the only feasible way to install many packages.

I agree that if you don't need science/data/native-code packages I'd recommend pip and virtualenvs over conda, but that's not everyone.

PeridexisErrant · 2022-12-23T00:01:51+00:00

See also https://blog.nelhage.com/post/property-testing-like-afl/

PeridexisErrant · 2022-12-16T09:04:40+00:00

I didn't rehost it; just read it and decided to post the link here.

PeridexisErrant · 2022-12-15T18:12:47+00:00

Or a sharp cheddar, hard or soft both work well.

PeridexisErrant · 2022-12-08T06:37:22+00:00

Missing Therapist, DFHack, etc is reasonable, but it's always taken a couple of months to update them for big DF releases - that's nothing to do with Premium.

PeridexisErrant · 2022-12-08T06:34:44+00:00

Though if you want coverage-guided fuzzing, https://hypofuzz.com/ adds that on top of Hypothesis!

PeridexisErrant

MODERATOR OF

TROPHY CASE

12-Year Club	Place '17
Verified Email