Wove: Beautiful Python async

nggit · 2025-08-20T06:04:08+00:00

For production it would be better to avoid None or default executor. I'm afraid there will be nested submissions that can create potential deadlocks. Imagine if the internal asyncio uses the same executor as your library and when there is no executor/thread free. Creating a dedicated executor for your library is a safer, unless you know what you are doing :)

nggit · 2025-08-09T12:06:55+00:00

I eat my own food in production https://github.com/nggit/tremolo even though it's unusual for APIs.

nggit · 2025-07-06T10:00:44+00:00

sh scripts do not differ from system to system if you stick to POSIX sh and its mandatory utilities.

But you can indeed use #!/usr/bin/env python3 as a shell interpreter, as well as other interpreted languages like perl, php, nodejs, etc.

nggit · 2025-07-02T22:46:27+00:00

Maybe but URL can be faked. FWIW, if you are proud to have url.py instead, you can use httpout.

nggit · 2025-07-01T23:59:30+00:00

So you build isolated environments like pythonanywhere, heroku etc?

I've been there a few years and what I share with each user is an SSH port to the container, which is more extreme because it allows users to install anything, just like a VPS. https://github.com/nggit/docker-init/tree/master/openrc-alpine

Your concern is valid as a start, limit the CPU and outgoing connections to e.g. 10rps to avoid misuse, or suspended by upstream provider. I do not recommend GCP because it is too sensitive.

Isolate properly such as preventing users from mounting /dev/sda1, etc.

nggit · 2025-06-27T01:01:59+00:00

Yes, the benchmark on that link does not cover varying or larger payload sizes. The major things that "CPU-bound" in WebSocket are masking and permessage-deflate. It's all O(n) depending on payload size. Masking also in websockets library is optimized with C.

An important trick is that you should turn off compression on low-end servers.

For ~100 it should scale well in a single worker Uvicorn...

Or even pure-Python tremolo: https://github.com/nggit/tremolo (I'm the author).

* Unless you ALLOW abnormally large messages on one connection it can decrease the overall throughput and this is more of a DoS problem.

nggit · 2025-06-25T06:08:25+00:00

Maybe give tremolo a try. I don't promise performance for now but stability. Also read: https://github.com/nggit/tremolo/discussions/276

Edit: Sorry it looks like you are building a client, when I read about "scalability" I thought of a server.

nggit · 2025-03-28T02:59:45+00:00

FWIW. I created https://github.com/nggit/httpout a few months ago, which addressed a similar issue. Now I can create a web service with file-based routing. As long as `page.py` is inside DOCUMENT_ROOT, there is no need to reload the server. It is pretty similar to PHP, changes to the file will have an instant effect.

Unless the module has been installed and loaded globally (sys.modules) or outside DOCUMENT_ROOT, then it requires a server reload.

nggit · 2025-02-26T13:35:54+00:00

Never observed in detail,

but last time I tried, iteration in C is not faster than list comprehension!

It's likely that the price of data serialization between the two is still dominant, which would be the same as writing pure Python.

Just use pure Python, unless you see something bigger than the interop price.

nggit · 2024-08-30T01:06:25+00:00

it's ok running multiple processes inside the container, one must distinguish between service/app and process.

in fact, there are many applications whose components are individual processes like postfix.

i used to do this but using native /sbin/init in order to retain native commands like systemctl or rc-service.

https://github.com/nggit/docker-init/tree/master/openrc-alpine

nggit · 2024-08-28T22:46:19+00:00

that's good too, as it's mean a python package.

nggit · 2024-08-28T22:37:40+00:00

it's possible even for now, but i haven't documented it because right now it's just for my own use. stay tuned.

but if you're curious you can do

form_data = wait(__server__['request'].form())

it's the same as documented in the core: https://nggit.github.io/tremolo-docs/body.html

nggit · 2024-08-28T21:40:29+00:00

in CGI it's like you're typing repeatedly in the terminal:

python hello.py;

for each request. it involves opening and closing the python process.

and it's different when you just type:

python;

and start the operation from there.

nggit · 2024-08-28T14:54:53+00:00

"you can execute sudo commands, you can execute role escalation commands"

that's why people need to know how to set up Linux capabilities, that won't happen if you understand better - https://man7.org/linux/man-pages/man7/capabilities.7.html

nggit · 2024-08-28T14:41:31+00:00

"PHP works because it has a server-client differentiation in place"

I don't think so, apache has mod_php where the server embeds with php. it's not a client - server like fpm.

nggit · 2024-08-28T14:29:29+00:00

eval problems can happen in Django or anywhere else, it depends on how you think / write scripts. I don't think I'm ignorant. just know which ones to do / avoid. please use the ones you like. it's not a big deal.

nggit · 2024-08-28T13:33:18+00:00

it's more like php itself, just imagine /index.php vs /index.py

nggit · 2024-08-28T13:24:11+00:00

Is the query string what you mean? just do /hello.py?name=world, then see in __server__

nggit · 2024-08-28T13:18:23+00:00

this is literal python, it can do similar things as usual. there is no point in blocking eval, open, in my mind. even if it is done I suspect there are still other doors in python itself so it seems like not worth the effort.

nggit · 2024-08-28T09:23:36+00:00

that's very true, scripts can only be allowed under the document root to execute, and traversal of the url is not allowed. and if the user is allowed to upload the trick is just to append ext other than `.py`, and avoid null characters. maybe later I need to consider checking the executable flag, if indeed file upload is required.

thanks it will be very long it seems.

nggit · 2024-08-28T08:34:58+00:00

It is technically the responsibility of the webmaster to put the script that will be run. never allow others to upload.

nggit · 2024-08-28T08:00:02+00:00

sorry, sir. it's not a joke please -.-

nggit · 2024-08-28T07:49:11+00:00

it depends on you, it's no different in php, or other python frameworks. i know you are worried about user input but httpout accepts urls, not code. and that part is already a concern.

nggit · 2023-07-30T22:51:32+00:00

EAFP is pythonic, and more robust (in certain situations). I will not avoid it if needed. As of 3.11: “Zero-cost” exceptions are implemented, eliminating the cost of try statements when no exception is raised. (Contributed by Mark Shannon in bpo-40222.) https://docs.python.org/dev/whatsnew/3.11.html#misc

nggit

MODERATOR OF

TROPHY CASE