Python Bytes - #396 uv-ing your way to Python

Episode Date: August 13, 2024

Topics covered in this episode: uv venv --python & uv python Python 3.12.5 released Compile and use dependencies for multiple Python versions in Tox Catalog of Dark Patterns Extras Joke See the full show notes for this episode on the website at pythonbytes.fm/396

Hello and welcome to Python Bites where we deliver Python news and headlines directly to your earbuds. This is episode 396, recorded August 13th, 2024. I'm Michael Kennedy. And I'm Brian Ocken. And this episode is brought to you by Scout APM. Thank you to Scout for their continued support of the show. Check out their link in the show notes. We'll tell you more about them later.

If you want to follow us on the socials, you can find us all over on Macedon links at the top of the show notes. And we are on X, although less active than we are on Macedon. I would say we're gonna catch the live show. You can do that at pythonbytes.fm slash live and takes you either to the old ones or lets you know about the new one if it's running right there. So we appreciate when people are there, but audio is always, always works as well. Brian, how are you doing? I'm good. Um, yeah, I didn't, I didn't know we were still on X, but well, you're an X. Here's the thing. Oh, see, you're not on X anymore. Okay. Did you

actually delete your account? I have an account, but I check it like every other month or something like that. I still get notifications if people will at mention me. Then I'll see it. But it's kind of the same thing. I don't like drop in and cruise through there as much. I'd be happy on Mastodon, but there's just, I would say, 75% of the people that follow us, interact with us, at least through the show account, probably didn't make the transition.

Okay. I should pay attention more. Still there for them. Yeah. We're still there for them. Okay. Good. That's all I meant by it.

Okay. All right. Well, let's kick it off with you first time. Okay. I want to talk. I think I already covered UV, a a uv article yesterday a lot yesterday yeah it was the summer time you got to be real careful about your uv index and yeah put on your oh wait no not that i love oh my god we could put together a uv index it'd be like the uh

that would be awesome um anyway so uh i saw this article Python packaging is great now. UV is all you need. And I'm like, eh, I don't know. It seems like a little silver bullet-ish for me. But I took a look at it anyway. This is from Juan Luis Cano Rodriguez. Awesome name. And cool profile picture. Anyway, so UV, what is, we like to bash on packaging but it's it it's just continually

getting better and um and uh especially with people like brett cannon trying to continue to make it better it's going to and people at uv um at astral making uv better but what so what is this about um this article i i didn't really want to completely cover the article, but there's some pretty cool stuff here. So bootstrapping, getting a project started is difficult sometimes or knowing what to do. And I've been using UV for making virtual environments, and it's really fast at that. But I took another look at it. There's been some updates that I didn't know it did some cool stuff. So one of the highlights here is UV Python manages Python versions. And

I'm like, what it does what? So I went and checked it out. And you can you so you don't even have to so you can go down and say uv python install and it installs python versions for you and it's really fast but you don't have to um and i'll tell you why in just a sec uh you can um you can install it like that but you can also say uv python list and it lists all the python versions that it can find on your system but uh if you say UV, V and V, so creating a virtual environment, you can give it a Python flag with a with a number. So you can do list to add a time and it tells you not only what versions are there, but also what versions it has available. So you can, you can say like, if you don't have 311 on your system, you can say 311 anyway, and it'll install it. say like, if you don't have 3.11 on your system, you can say 3.11 anyway, and it'll install it.

I'm like, does that really work? So I checked it out. I tried it. I personally, it said that it would just do it automatically if it wasn't there. But I had to add the Python. There's a flag called Python preference managed, and it's listed here somewhere. Anyway, Python preference managed. Dash's listed here somewhere uh anyway python preference managed dash python preference and then you can say uv managed yeah only managed a managed system or only system got

you awesome yeah um yeah python preference and but if you say managed um which is supposedly the default but i had to pass it in anyway it just does does it. So I'm like, this is cool. And I installed like six versions of Python on my Mac yesterday in seconds and just just to have fun, to create virtual environments. And it's just neat. So I only really need a Python with I usually use Python within virtual environments. So being able to just install one into a virtual

environment is cool. So what else can we do? So the there's other things that UV can do that, like it can initialize pyproject.toml for you. And it sets up if you do a net, it sets up pyproject.toml and a readme and a source layout, It doesn't do a lot but it gets you started. The the thing that I thought was neat is add so you can add the depend dependencies to your pipe project Tomo with UV add and so you don't have to look up the syntax for it. The other cool thing about it is you can give it the dev flag you can say UV add dash dash dev, like you can say dash dash dev pi test, and it'll add pi test to your development dependencies, which is neat. So I guess I was gonna say packaging is not solved with UV, but maybe maybe it is. There's some pretty cool stuff. This is awesome. Yeah.

If you look up if you say UV help um there's a whole bunch of experimental um experimental items through here so there's run a knit ad a lot of these are experimental features tree is cool you can do a project dependency tree uh using uv so there's a lot of stuff that i used to use other tools for that uh uv is doing so kind of cool blocking like the creating self self i like it what does manage the uv executable itself oh yeah okay so there was a lot of drama honestly not on our show but on the mailing lists when this was announced with uv python or uv no with uv pip uv pip yeah yeah yeah yeah and so the reason that charlie and team chose uv pip as part of the cli uh interface as a sub command was so that they had space to do all these other things so if you just said uv install well is that install the python thing is that install

a package like right and so they put that in in there as almost like a namespace for all their commands and stuff. And how much new stuff is under these experimental sections? Starting to feel like, okay, this is what they had in mind, right? Yeah. Yeah. So the experimental part makes me nervous to put it into my normal everyday workflow a little bit. But for personal workflow stuff why not play with it um yeah so i you know as you're going through this and seeing this title python

packaging is great uv is all you need i think it's all i use these days i don't think i use anything else there are some systems that the whole especially with certain firewalls that i know you can get around it with uv but I've, there are some systems that I work on where I have trouble getting, uh, working with UV, but pip works fine. So. Oh, interesting. Okay. Yeah. I have basically three or four, uh, maybe four or five aliases that are just like two or three letters that will do all the company, you know, like the full commands with, with this and that. So those used to be pip commands. Now they're uvpip with like the different parameters and stuff. Yeah. And I try.

So when uvpip started came, I tried to alias pip to uvpip and same with virtual environment. But I realized that I kind of like control. I like to be able to use both. So I just sort of taught myself these uv commands. Yeah. Yeah. Sounds good. Not too hard. Is it? All right. Well, I have a set of bookends around Python versions to start and end

the show here. So let's start with Python 312. Five was out just last week, came out right after the show was released, I think so we didn't cover it but yeah here we have a brand new version of the most recent version python and i just checked by the way what yeah and i just checked with the uv python list and i think 3124 is the latest there just to give you a sense that like one week into it, apparently we don't have the latest. I was kind of hoping like that thing would be super cutting edge on top of it. So, uh, but I wonder if I, um, you know what, it's possible that, um, my UV is over a week out of date and it doesn't know, right. Something like that. I don't know. Anyway, three, 12, five is

out. And if you scroll through, I'm linking to the release notes. Sometimes it's hard to find like what is actually changed in say 3.12.4 to 3.12.5. Because if you go to the, if you go to python.org and click on downloads, a lot of times it'll just show like, well, here's what's new for 3.12. You're like, great. And from the last one that I had to this one was that, but if you go, you can find the release notes, which I'm linking to. And so there are a lot of releases and changes in just this minor point release. So we've got a bunch of tests that are fixed. How about that, Brian?

That's great. Yeah. Two different security improvements, patches, I guess. You know, they're not, don't think they have CVEs. So there must not be too bad, like audit, like missing audit events around certain behaviors, like, okay, so you couldn't audit it properly. But it's not, it's not a, you know, all your bases are belong to us sort of thing. Bunch of stuff in the library. So for example, a new version of pip. So for just a moment, just briefly, when you create a virtual environment, I won't say your pip is out of date.

But things like this, fix crash when importing SSL after the main interpreter starts. Hmm, might want to have that not happen. Handle value errors raised by iOS.stat. Fix some error messages in pickle. Here's one that's worth paying attention to. Fix a segfault in asynio.task at coroutine. Okay, you know, a lot of times you think of, at least I think one of the really huge advantages of Python is when stuff goes wrong, your program doesn't just go poof and go away. It reports the error, it gives you a chance to

catch it, right? Python itself doesn't die. It knows something's gone terribly wrong and it shuts down, right? But if you see Python seg vaults then it just goes poof and goes away so there's a ton of stuff like this so i just wanted to call call people's attention to all the changes here and there's even some that look like performance for example what was it f strings if you have an f string that has just one entry into it it i think it used to create an abstract syntax tree to try to build it up. And they're like, not really needed all that stuff for a single f string, or f string with single entry in it. So yeah, that's, that's gonna be a nice performance improvement as well. So the dash, how do they string it? Yeah. So anyway, these

are all good things. Yeah, definitely. F-strings are getting more secure, more fast. More fast or better. Faster, better, stronger. We have the technology. We can rebuild it. Okay. Can you even imagine going back to the time before F-strings?

It was a dark time. It was a dark time. My percent key still has no characters on it. No, just kidding. Yeah. Indeed. Yeah. Indeed. Okay. And before we go on to the next one,

you were probably going to give us some really awesome segue there. But let's talk about Scout APM before we move on. Okay. Let me tell you real quick about Scout APM. They're big supporters of Python Bytes, so we appreciate that very much. So if you are tired of spending hours trying to find the root cause of issues impacting your performance, then you owe it to yourself to check out Scout APM. They're a leading Python application performance monitoring tool, APM, that helps you identify and solve performance abnormalities

faster and easier. Scout APM ties bottlenecks such as memory leaks, slow database queries, background jobs, and the dreaded N plus one queries that you can end up if you do lazy loading in your thorium and then you say, oh no, why is it so slow? Why are you doing 200 database queries for what should be one? So you can find out things like that. And it links it back directly to source code so you can spend less time in the debugger and healing logs and just finding the problems and moving on. And you'll love it because it's built for developers by developers. It makes it easy to get set up. Seriously, you can do it in less than four minutes. So that's awesome. And the best part is the pricing

is straightforward. You only pay for the data that you use with no hidden overage fees or per seat pricing. And I just learned this, Brian. They also have, they provide the pro version for free to all open source projects. So if you're an open source maintainer and you want to have Scout APM for that project, just shoot them a message or something on their pricing page about that. So you can start your free trial and get instant insights today. Visit PythonBytes.fm slash scout. The link is in your podcast player show notes as well. And please use that link. Don't just search for them because otherwise they don't think you came from us.

And then they'd stop supporting the show. So please use our link PythonBytes.fm slash scout. Check them out. It really supports the show. Over to you, Brian. All righty. I want to talk about talks a little bit. We haven't actually brought up talks talks a little bit we haven't talked

actually brought up talks for a while i don't think but uh there's a there's an article on victor remark rimark victor rimark's blog um about compile and use dependencies for multiple python versions with talks and um it's kind of a kind of a neat idea. I use Tox for incorporating it with GitHub Actions a lot to be able to, well, and just locally, to be able to test multiple Python versions and multiple versions of different libraries, how they work together. Tox is great for things like that.

But one of the things that I didn't think about was doing pinning, like compiling pinned lists or lock lists for dependencies for multiple Python versions. And so this article walks you through kind of why you would want to do that, but then also how to. And the little trick here, which I think is cool, is that talks uses a environment name called the ENV name.

And so there is a way to get your, to be able to specify, use that to look at different, the talks environment that it created, because it creates a little virtual environments when it's running. But the neat thing about that is you can use it other places, and the idea around this was to go ahead and use, this article uses pip tools, but, but

really I think you could use anything, but to target a compile like a pip tools, compile and and send it to using pip compile and using PI project Tom was the base file and then outputting to a requirements in in v name which is uh or a env.txt or a like a env-dev.txt so you could do like a requirements with a requirements file essentially with um with your environment uh specified in it uh you could in this example it's using a directory uh pumping them all into a requirements folder with a directory, but you could also do, you could also do a directory. And then also, I also like to have a requirements dash whatever. So even if I had them all filed into a directory, I usually put something like requirements dash 312 dot text or something like that. But having that be able to specify it from the project allows you,

allows the little trick to be able to say, Oh, here's an example of with the requirements dash. I like that a little bit better. But to, to have a requirements target within talks so that you can use that to compile your project, compile those. And while they're running your instance, instead of like in CI or something could grab those.

And instead of generating a, just whatever it can find it's a pin or pinned or a locked set of set of dependencies might be a little bit more consistent. So, so that locally the, of dependencies might be a little bit more consistent. So the idea would be then locally, when you're testing yourself, you can say, hey, I'm ready to update my dependencies, and then it regenerate all of the dev files or all the lock files. And then later, when CI is running, it doesn't look up dependencies. It just knows the fixed links or the fixed versions.

So kind of a neat idea. I wanted to highlight that. I also wanted to highlight this because I like this idea, but I want to do it with UV. And I think I'll play with this. But if anybody else has time to play with this and see if they can get it working with UV, I'd love to see the outcome. Yeah, that's awesome. I imagine you can because if it was using pip tools,

it's got the pip compile behaviors. It shouldn't be that hard. Yeah, yeah, it's awesome. Yeah, this looks great. I love it. What do you got for us? Let's close it out with, I think, dark. I did tell you it was the 13th, didn't I? it. What do you got for us? Let's close it out with something dark. I did tell you it was the 13th, didn't I?

Yeah. So I present to you a, this is not exactly a Python thing, but I feel like this is anyone who builds web apps or other types of apps and interacts with users sort of thing. So superset, if you will. I present to you a catalog of dark patterns for software.

Dun, dun, dun. Dun, dun, dun. It says, discover a variety of dark pattern examples sorted by category to help you better understand deceptive design practices. So there's some that you probably would know, like Bait and Switch. And each one of these has at least one concrete uh like case study of evil badness of darkness let's say so the bait and switch one which says this tactic lures users with an enticing offer only to change the terms unexpectedly so they've got a lift 60 off wouldn't you like 60 off of your next ride just click here and sign up brian and then once

actually your next two ride that says right here yeah but then actually as you try to apply it it turns out it only count counts towards 60 off the first 10 so if you like went to the airport it was 50 bucks it's like well you know it's still 44. yeah perfect uh so that's not ideal. To me, the classic bait switch is the cable companies for internet or anything. Like, don't you want to add like a home phone, like digital phone, and then you can add like the sports package and it's only $5 more for the first six months and then it's like $150 more. So I had one just like yesterday. I had an email from my cell phone provider that said, since you've been here like so many numbers of years, we're going to give you 10% off. I'm like, that's cool. And I clicked on it and it was 10% off any of your case purchases. So shady. So shady. So that, I mean, people probably know that one, but there's other ones that are, um, interesting. Like one that I really like is the roach motel. Okay. easy to sign up, but nearly impossible to cancel. So there's, you know, you can't, there's not like a, just unsubscribe us button. You've got to call somebody and they try to talk you out of it. Like

I'm a hat, hat tip the cable companies again on this. Yeah. Right. But yeah, there's one, one click subscribe, but if you want to, if you want to cancel, please come down to our office during the hours of four and three exactly exactly and if you don't get through the line of people backed up trying to get out of it then uh you'll you'll uh do that try again the next week so there's a bunch of these i'll do one more just people go play with them disguised ads oh i thought it was disgusting ads disguised ads, disguised ads, okay. Disguised ads, which are themselves disgusting, but the pattern is disguised. So Microsoft Edge, for example.

And I feel like Google, this is towards Google Chrome, like a thing towards, I feel like it's also kind of reverse a lot of, like Google does that as well. Like, wouldn't you rather use this instead when you search for something? Anyway, I'll give you the example that's on the page. So you may encounter not one, but two dark pattern patterns when attempting to get Google Chrome onto your computer.

When you have Microsoft edge, this happens when you have a empty install of windows, you have edge installed, but not Chrome or, I mean, I feel like installing Chrome itself as a dark pattern that you should just avoid. Use of all the brave Firefox, something else. But anyway, that's not the point. There's two here. And the first one is disguised ads. The second one is confirm shaming.

And so this is like a good case here. So if you go over to google.com slash Chrome in Edge and you go to the down, you go to the, like the, where you get to download it. It literally has a built into the browser pop-up that comes out of the menu bar, you know, that address bar rather says, I hate saving money. Said no one ever. Microsoft Edge is the best browser for online shopping. Just by literally visiting the Chrome page, you get this pop up that's like integrated not into the HTML but into the UI of the browser. That's so funny. Yeah, so that's that's shady. That's one.

I kind of love the boldness of that though, actually. I know. And then if you go to go to Bing, I believe this, which is the default search engine, and you just search for Chrome, you get some results. But then there's like this other part. Oh, no, this is actually in the start menu. This is in the start menu. So if you type Chrome, like try to run Chrome, half of the whole start menu says,

try Bing wallpaper. Switch to the browser recommended by microsoft download edge here oh dude that's rough uh yeah so what's cool is it says look here like it kind of highlights the various patterns that are here and then like other companies that do similar patterns anyway i think this is interesting reading i think figuring out like just being aware of this stuff so if you're involved in building these things, you're like, Hey, guys, people are gonna not like us, could we do this a little bit differently? You know, sometimes marketing will win, sometimes developers will win,

but so are these dark patterns or? Or maybe growth hacking? Yes Is this our yacht? Or is this a dark pattern? Could it be both? What could I incorporate these into? Hashtag you win if you can get like all dark patterns. Oh, that'd be fun to try to. It'd be a good growth hack because then you could appear under every category. It'd be like some like link.

Pre-advertising. Exactly. Yeah. Anyway. Yeah. This is what I got for you. Kind of interesting. Nice. You got any extras you want to share? The extra I wanted to shout out was just

I've been I think I have my recording done for HelloPytest. The only thing left to record is the summary at the end. There's a few things I want to, like one extra video I want to record, but I want to edit everything first. So I'm in the process of editing and keeping track of everything so that at the end I can go, hey, we went through all these things. So I want to make sure. Actually, the thing that

I have left is I want to review all of the command line flags that I use in the course. But I don't remember all the ones I've used. So I'm writing them down as I'm editing. Nice. That's awesome. But I'm on track for August 19th. A few people have ordered already. Thank you so much, everyone that's ordered so far.

So love you. My wife loves you. We went out to get coffee off of money we got from this. Beautiful. Yeah. Available for pre-order now. Yeah. What you got?

I have just a couple of things. Django 5.1 released. So big deal here is easier guardrails for authentication because having people access stuff that was supposed to be authenticated but isn't is bad. They didn't say that. That's my words. The new and shiny login required middleware is available, which enforces authentication for all of yous. Better screen reader support, better HTML semantics. The second oldest ticket is now fixed with a long awaited query string template tag.

So these things are all good. And let's see, was there, I thought there might've been a CVE or something in here, but I don't think so. I saw Django CVE not too long ago, security deal, but it doesn't seem like it's addressed with this one. So it must have been fixed previously. All right, so that, and then here's the bookend. We started with 3.12.5 being available. Well, how about Python 3.13 looking forward with release candidate one is out. So this happened a little bit ago, but if you're out there and they say, please test,

you have a package, especially a popular one, please test it with Python 3.13 ahead of time so we can do stuff about it. And you're like, oh, it's betas. I'm not gonna take the trouble. Not gonna worry about it. Well, it's now officially stable in terms of features, right? They're not gonna add or remove things ideally

unless they absolutely have to. So you should be able to properly start putting energy into testing and playing with this one and this one is a big deal because this is the first free threaded python which is going to have significant effects on runtime behavior not just this api still work right so it's it's going to be worth testing with this one all those other versions of python you have to pay for threading this This one's free threading. Yeah. It's awesome. Finally, finally it's free.

You just have, yeah, you have to pay by buying other machines and running copies on them to get parallelism. Um, no, I, so I was hoping that UV Python would have 313 there, but it doesn't yet. So well, yeah, that would, all right. UV team out there listening. Come on Astro. what are you doing? Exactly. Let's turn UV Python into like,

this is how I get the freshest Python, which is actually one of the things that's a little tricky. Like homebrew, it takes a week for that stuff to show up and other stuff, yeah. A week? Yeah, who wants week old coffee? No, no. Your threads are totally stale by now.

It's a goofy episode man it is all right i know you got the joke for us this week so okay he's out well actually um before we get on to this i was just thinking because you you wanted when you were talking about django um i thought of a new uh of a a dorky joke so what do you call a 17-year-old insect? A minor bug. Oh, that's pretty good. Okay, so I saw this Ars Technica. Is it Ars or A-R-S? I don't know.

A-R-S Technica? I say Ars, but I know now you say that. I'm not sure I've ever heard anyone pronounce it. Okay. Go with Ars because it's lowercase ours technica uh had an article parody site clown strike refuses to bow down to cloud strikes bogus dmca takedown uh so there's an article here um i wanted to check it out myself um so if you go to uh clown strike dot lol um and we'll refresh it.

Let's see if it starts out looking like CrowdStrike, but it has a little goofy hat on it. And then if you, I'm not going to play the music now, but if you play music, it's got like some, some goofy little music

that goes along with it. And there's a clown. That's it. That's just, it's just funny. But now if you click on the left, it tells you about all this. Well, it tells you the ars technical article but it also talks about this story about how they had these takedown uh crowd strike tried to take them down and it's just silly um there's some other stuff here too that i think is just hilarious like uh uh the what scam advisor lists clown strike lol as

a highly trusted might be safe it's like nothing there except for just this goofy little picture and um but uh but there are some some some other stuff in it you can read the whole story and all the letters about or all the emails back and forth about the takedowns and actually um there i was surprised to find out that they had to like cloud for cloud flare was uh was um was hosting this but it it like accepted the takedown at first um and eventually backed down but even after but after it got moved but i'm surprised that it got taken down so fast because obviously this is a parody site um and parody is protected there's no way like even a cursory look at this anybody would think this is a realistic uh yeah it's not trying to impersonate it or anything like that for sure just making fun of the situation and and i think that they just

probably i mean they really should have just ignored it because now clown strike is known or anything like that. Yeah, no. Just making fun of the situation. And I think that they just probably, I mean, they really should have just ignored it because now Clownstrike is known and we're talking about it and Ars Technic is talking about it. Exactly. It's the Barbra Streisand effect, right? Yeah.

Oh, boy. Anyway. Yeah, I'm somewhat sympathetic to CrowdStrike, but this is a bad look. You know, if you've got to write native code that runs in the kernel, the smallest mistake, and it has to be updated within hours of you learning new information, I don't know. It's tough.

Apparently, it's one of the best antivirus systems out there that actually works and isn't just, you know, you want to talk dark patterns. Like a lot of this antivirus, clean your computer stuff is really shady but boy did they cause a problem and i would not want to be in their shoes no well i don't know i mean a couple weeks of shame over you get billions of dollars to pay for that shame so yeah i think they're gonna get a lot of lawsuits from a lot of angry fortune 500 companies and even if they win, defending them is going to hurt them bad. If it doesn't kill them, it's going to hurt them bad. Okay.

So, sympathies out there for somebody? A little bit. A little bit. A little bit. But I feel like they've certainly earned this website. And wow, I didn't know LOL was a top-level domain. Yeah, it's funny. It makes me laugh. Yeah, it makes me laugh. I didn't know. LOL was the top level domain. Yeah.

It's funny. It makes me laugh. Yeah. It makes me laugh. Wonder what that stand, what it is. Is it like a country? Is it literally low, like laugh out loud or is it because they're like dot pizza is the top level domain as well, which just seems wrong. Oh, that is, does seem wrong.

Really? I think so. I'll have to check that out. Like pepperoni dot pizzaizza and like Hawaiian. Honestly. Yeah. Pineapple. Maybe we need to get some domains.

Yeah. Anyway. Okay. Awesome. Thanks for sharing. This is great. All right. And thanks for being here like always.

Thank you. Bye. Bye.