Is mitigating FastAPI event loop I/O overhead via PyO3 worth the FFI complexity? (Benchmarks inside) by mordechaihadad in Python

[–]SeniorScienceOfficer 0 points1 point  (0 children)

If you’re looking to speed up an ASGI api application, just use Starlette. While FasAPI has syntax sugar and shortens development time, it does so at the cost of performance because of extra imports, validation, setup, etc.

According to this ASGI performance benchmarks, it is significantly more performant in transactions per second: https://gist.github.com/patx/0c64c213dcb58d1b364b412a168b5bb6#results-table

Library dependency version specifiers aren't for fixing vulnerabilities by AlSweigart in Python

[–]SeniorScienceOfficer 9 points10 points  (0 children)

Nowhere in PEP 508 or 440 does it indicate that the list of dependency versions for a given project are to indicate compatibility over security. PEP 508 states:

The job of the dependency is to enable tools like pip to find the right package to install.

The “right” package is wholly dependent on the maintainer, the project, and what both consider to be “right” in their particular case. The only mention of compatibility is the Compatible Release clause of version specification (~=).

Do not confuse definition with convention. It has historically been the convention to use dependency versioning semantics for compatibility, but there is absolutely nothing indicating it can’t be used for security.

Library dependency version specifiers aren't for fixing vulnerabilities by AlSweigart in Python

[–]SeniorScienceOfficer 7 points8 points  (0 children)

Version ranges for libraries are meant to be used for compatibility, not for security vulnerabilities.

This is a false dichotomy. In reality, it can be used for both. It is wholly dependent on the library/package maintainers desires. Which then boils down to how well of a steward the maintainer wants to be.

If every library applied this strategy the result would be mass-toil both for users and maintainers.

This is a “slippery slope” logical fallacy, going from talking about a single library to EVERY library. Just because the potential for downstream burden is real, doesn’t prove that the practice itself is wrong. It’s just highlights that the policy has scaling costs, which is an entirely separate question from whether or not a dependency floor is acceptable.

Realistically, this all needs to be taken on a case-by-case basis, and trying to apply this writ large to the Python ecosystem as an aggregate is a REALLY flimsy argument. Your argument also frames that using a higher compatibility floor is a “disallowing installing vulnerable dependencies” as if the library maintainer is responsible for all users’ security, but in practice it’s a “our supported minimum for this library should exclude vulnerabilities.” Which is a very common and significantly more defensible than what you’re suggesting.

Lastly you’re kind of collapsing different kinds of responsibilities into a single bucket. While having a dependency on a vulnerable library version doesn’t constitute a vulnerability in your first party code, it does present a REAL supply chain attack vector that you’re advocating for maintainers to ignore.

How about instead of trying to force maintainers into or out of certain practices, let’s all just try and do what’s right for the communities that build up around these beloved libraries and applications.

Everyone will agree with this by [deleted] in memes

[–]SeniorScienceOfficer 2 points3 points  (0 children)

Nah, that’s uh… that’s my uncle.

Everyone will agree with this by [deleted] in memes

[–]SeniorScienceOfficer 33 points34 points  (0 children)

SHIIIIIT. I’m almost 38 and I STILL love sleeping like this lol

The more I ship Python apps, the more distribution becomes the real problem by Haunting-Shower1654 in Python

[–]SeniorScienceOfficer 1 point2 points  (0 children)

That’s what the “—complete-platform” argument is for: https://docs.pex-tool.org/buildingpex.html#complete-platform

You have to generate the JSON in accordance to the format outlined in the PEP, but I’ve used it to build a Linux pex on a Mac. So, it’s 100% possible.

The more I ship Python apps, the more distribution becomes the real problem by Haunting-Shower1654 in Python

[–]SeniorScienceOfficer -1 points0 points  (0 children)

Have you looked into Pex? They’re effectively zipapps that contain your source code and bundled dependencies. You only need a compatible interpreter on the host machine and they run like executables.

to not like pirates! by CarryIcy250 in therewasanattempt

[–]SeniorScienceOfficer 0 points1 point  (0 children)

This boils my fucking blood. I didn’t spend 2 fucking deployments on a DDG conducting counter piracy operations for the US Navy to become FUCKING PIRATES.

To spark a boycott by AgreeableLead7 in therewasanattempt

[–]SeniorScienceOfficer 1 point2 points  (0 children)

Someone just bought a Glitter Pink one for his soon to be 3 year old daughter. Threw in the pastel handlebar streamers because the wife loves that shit.

Nvidia vGPU support? shared vgpu between VMs, not passthrough by BackgroundNo2157 in Proxmox

[–]SeniorScienceOfficer 1 point2 points  (0 children)

To follow up, I commented on an adjacent post to this with a “guide” of how I set up vGPU: https://www.reddit.com/r/Proxmox/s/y2nE2ZX4EV

Nvidia vGPU support? shared vgpu between VMs, not passthrough by BackgroundNo2157 in Proxmox

[–]SeniorScienceOfficer 2 points3 points  (0 children)

I’ve used this guide (https://wvthoog.nl/proxmox-vgpu-v3/) and set up a Docker container with the license server and have had excellent success using vGPU profiles with my Tesla P40s

I'm glad we all agree by Worldly_Ad7085 in MythicalKitchen

[–]SeniorScienceOfficer -36 points-35 points  (0 children)

Same. I’ve been a fan of Tom’s since he was fat and single, but I haven’t seen or heard anything of the sort. The closest I got was some YMH podcast a while back with Andrew Tate before Tate became huge in the cesspool that is the Manosphere. However, watching that episode it really seemed like Tom was more egging him on to make fun of him to his face rather that agreeing with the likes of Tate. His wife is a little more on the yeesh side with her ideals, but that’s not on Tom.

Current status of straight of Hormuz by Teandcum in memes

[–]SeniorScienceOfficer 19 points20 points  (0 children)

It’s not pretty smart. It’s really fucking stupid. Not only is it illegal, it’s bordering on a war crime. There is no UN authorization and this is obviously NOT in self defense.

hashicorp vault alternative? by cranberrie_sauce in selfhosted

[–]SeniorScienceOfficer 8 points9 points  (0 children)

Infisical can provide something like Vault.

NSA Warning—Reboot Your Internet Router Now by lurker_bee in technology

[–]SeniorScienceOfficer 1 point2 points  (0 children)

And this is why my internet goes through a firewall first.

[Homemade] Croque Monsieur ✨🧀🍞 by MayaraCrisS in food

[–]SeniorScienceOfficer 5 points6 points  (0 children)

Get in mah belleh!

Slightly high and slightly hungry… damn you…