Transcript: MongoDB - Aaron Bassett

I'm Carlton Gibson, joined as ever by Will Vinson.

Hello, Will.

Hi, Carlton.

And this week we've got with us Aaron Bassett, developer advocate for Mongo and all-round good guy, member of DSF Board and All Round Good Guy.

Hello, Aaron.

Hey, Carlton.

Thank you for joining us.

Welcome to the show.

Let's kick off.

Tell us about yourself and how you got into Django and how we know you and all those things.

So that we've got your backstory.

Yeah, so as you mentioned, I'm a developer advocate for uh MongoDB, which I know is not probably the first thing people think of when you think of Django with MongoDB, but uh I've been a kind of member of the Django community for well since before Django hit version one, to be honest.

Uh I used to, before I got into developer advocacy, I was a software engineer, um, worked for a couple of different software agencies, and one of them I was lucky enough to be able to convert from a uh a homegrown PHP CMS into using Django.

So that's kind of where my my love affair started.

Um and I've been a heavier user of Django ever since.

Talked several times at DjangoCon Europe and uh DjangoCon US, and as you mentioned, of now been a member of the DSF board for the well, almost a year now.

Elections are coming up soon.

So I'm glad that didn't come across.

Um that was actually the conference as well, where I decided to uh to become a developer advocate.

I um was still working in uh software engineering at the time for a company based out of Edinburgh and I'd come to Florence to give the talk, had been asked to help uh Mark Smith out at the Nexmo booth, um, as they were a bit short-staffed, and then kind of realized, like, oh, so you give talks and go to conferences for a living.

Like, you don't pay to be here, you get paid to be here.

Um, and that's when I decided to make the move myself.

Yeah, um and uh so what yeah, what what was the appeal of being a developer advocate?

Um, you know, I whenever I used to live in Glasgow uh many years ago, there wasn't a huge tech community there.

You know, there was a tech community in Edinburgh, and that was really seen as being the the heart of um kind of software engineering and development in Scotland.

But Glasgow really didn't have that same sense of community.

There was a lot of developers in Glasgow, uh, most of them working in um finance, but there wasn't really any kind of meetups and there wasn't any kind of social events or anything like that.

And a group of us got together and decided to fix that.

We were very community-minded, wanted to have an excuse to go out and have a couple of beers with similar-minded folks.

So we started a meetup called Web Centric.

Um, the founders of that went then went on to find things like Tech Meetup in Glasgow and um Barcamp and uh Codecraft and a bunch of our different ones, but it was really that trying to look for a sense of community, which got me into it in the first place.

And although I was still just working as a regular kind of engineer in like an agency at the time, we started to like give talks at the meetups.

And as anybody who's organized kind of regular meetups with speakers will tell you, it's could be quite difficult to get speakers lined up every month.

Like uh Yeah.

Yeah.

Uh so it got to the situation where I was speaking at a fairly regular cadence at these different meetups.

Uh, you know, anytime we couldn't have didn't have somebody to fill us the slot, then it was like, okay, well, what's the topic of this month's meetup of HTML5?

Okay, right, Arn can talk about that.

That's fine, let's just put him in there.

Uh right.

Yeah, it was it was a great conference.

Like I'm actually probably my first ever Django Con.

And uh also my first time on stage.

I didn't give a full conference talk, but I I gave a lightning talk, which if anybody is listening is interested in getting the conference speaking, that's a great way to like test the water.

You know, that not a lot, not a lot of preparation required, you know, five-minute slot.

Everybody is so supportive, you know, it's just a nice fun time.

You get up there, it it's daunting.

Like I was surprised anybody could hear what I was saying because my legs were shaking that much.

I was sure that all you could hear was him tapping on the stage.

Like I was thought that was gonna draw night everything I said, but I came off the stage afterwards and was like, yeah, that was fun.

It was terrifying, but but fun.

My first talk was like a 40-minute one at Django Con.

That's not true.

I did it at Django Boston before that.

So uh to your point about uh having getting guests every month.

Uh I'm not one of the organizers, but I've worked with them and there was a while I was speaking a bunch.

And even in Boston, which has a lot of developers, it is it's so much work to be a organizer of these things, but it brings so much to the community because otherwise we're all you know in our offices on our computers.

And we actually ended up switching it so instead of having like trying to do monthly speakers, it was then they would have a cadence of doing, okay, well, one month we'll have uh talks, and the next month we'll do a dojo, and then the next month we'll um just have a social meeting, you know, just go to like a local bar and next month talks, dojo bars.

And it's it's a lot easier to find speakers kind of one every once every quarter, essentially, rather than than every month.

wants to speak.

So if you've got somebody who you know you maybe not be in the local community, but you know, um you really want to hear from, then you know, it's it gives you more time to organize and maybe like get their travel sorted and get them um through to the city and uh things like that as well.

One was like three years later, how are you still liking it?

Because you you're traveling all the time and all the rest.

And then the second part of that is how's 2020 been with COVID and all remote and the massive change there.

Um I went from I think at the peak, I was doing oh gosh, I can't remember what the distance was now, but it was like equivalent to four and a half times around the world, like per year.

So I've spent 56% of my working time on the road.

Okay, so yeah, a lot of travel.

I had no like I've no commitments at home or anything like that, so it was really the time to kind of do that that part of my life.

And I got I at that stage I was kind of well, I was on the road so often that it didn't even make sense to have a lease for a mortgage anywhere.

You know, I was literally away from home more than I would have been there.

So I ended up just the time I wasn't traveling for a conference to spending it in like Airbnbs or visiting different cities and stuff, and it it was great.

I don't think it's for everybody, you know, it's it's a very difficult kind of lifestyle to maintain for a while, living out of a 35-liter backpack.

Um, but for that time in my life, like it it, you know, I uh wouldn't trade it for anything.

You know, I really enjoyed it.

I got to meet some amazing people, I got to give a lot of uh conference talks, you know, and I got paid to do it.

It was great.

Whenever I moved from my previous uh position now to have MongoDB, the amount of travel was due to be less, and now it's none.

You know, it's uh with with COVID.

Well, I've I'm in Miami now, and that's that looks like where I'm gonna be staying for for the seeable future.

But um, we're finally starting to see a lot of these conferences start to to move online as well.

So a lot of the conferences I'd kind of been, I've just come out of a period of very hecticness because a lot of the conferences I'd like applied for in like you know, December, January that um were supposed to happen in you know May kind of time.

And they pushed themselves back to like the last kind of quarter, last two quarters of the year.

So suddenly had this glut of conferences come in in September, October.

I think my my peak last week was five in one week.

So um

Or do you do you are you more professional about it and able to get them done?

Uh yeah, so I've I have kind of some talks that I've given a few times before.

So they're they're easier because they're um obviously ones already presented and the talks already get to go.

Normally just needs to be updated slightly for any changes that have happened to libraries or or in the community.

Uh for new talks, I tend to start working on them really once they can kind of get accepted, but more in a very abstract way.

You know, I'll just start mulling it over and kind of thinking about it.

Uh, but I won't start normally writing it until maybe like two weeks before.

And then I I have this horrible habit of like two nights before the night before going, I hate all my slides, and then like pulling it all nighter and redoing every single slide.

Um, which I'm not able to do as much now because what I've started doing for the online talks is I actually use uh a teleprompter.

So for people who are not aware, it's you know like uh a piece of one-way glass, like a mirror fronted, which is uh has my a tablet being reflected on it with the essentially the script of what I want to say, and then mounted behind that is a camera.

So I'm reading off this mirror but looking directly into the camera, which I think makes a huge difference for talks because I'm not like looking down at my laptop, or you know, it's really difficult to give a talk and look directly into the camera because then I need to look down at my speaker notes or I need to look at other things, whereas this way I'm looking directly into the camera the whole time.

But it does mean I then have to have the entire script written for what I want to say, which I've never done before.

Normally I have my slides and I have a few bullet points, my speaker notes, and you know, beyond that I just kind of wing it.

So now what I end up having to do is do that, record myself winging it essentially, and then go back and write the script based on what I've said.

So there's a lot more prep required now for talks than there was whenever I was just traveling.

I've seen a few um photos on Twitter.

You all seem to have uh these kind of professional recording studios now with like sounded sounded sides and green screens and you know all the gear.

That's the only the apartment I'm in in Miami at the moment, it's you know very hip and modern, and it's you know, the unfinished concrete ceilings and very tall ceilings, all the rest, which means it's echoes, which you'll probably hear in my microphone at the minute.

I actually have two soundproofing panels either side of me trying to cut some of it down, and I'm using a lapel mic to try and cut some of it down, but even with that, it's still very radio echoey.

So I've got some of that stuff, then obviously you're trying to work in your lighting, and then you've got so like I use a DSLR for a cam link for the actual recording, and yeah, there's a lot of a lot of new equipment you need to think about, which we didn't have to before.

Uh, but I didn't, you know, I kind of feel bad expensing all of this in the company, but um, they're not paying to fly me halfway around the world at the same time, so

Yeah.

And you know, there are some cases where Mongo with Django might make sense.

From there, like how how are we going to use it with Django?

Because it dug you say it does is not the first thing that comes to mind, but you know, regularly there'll be a message to the um user group or the forum or the Django developers, you know, how do I use yeah, how do I use Django in Mongo?

Um historically, we've we've probably had more of developer evangelists than advocates.

The difference I see is with an advocate, you're as well as being kind of the voice of the community or sorry, the voice of the company in the community, you're also the voice of the community in the company.

So I I spend um time advocating for you know uh increasing or providing some support to to add uh support for MongoDB to Django.

Obviously, the difficulty of it being is um it's not something we can just fund.

You know, we can't just give a bunch of money to the DSF um to pay for it.

You know, there's there's restrictions there on on because of DSF's nonprofit status, that they can't essentially do like guided work like that.

You know, we can't pay and then our company can't pay the DSF um and requ for a particular piece of work.

You know, we could make a donation, but you that donation has to be just to DSF as a whole.

You can then prescribe what they should use that donation for.

So the fellows' role, it's interesting that we're the fellow as fellows, Maris and I, we're community managers, not there to write, we're not there to write software.

And even without that, the the separation between the DSF board and the technical board um is there for a reason.

And it means that we can't influence the direction of Django's development anyway.

You know, DSF's role is is not there to to steer the technical direction of Django, it's it's more there to look after the actual uh foundation itself and protect the usage of the trademark and ensure that the fellows get paid and that we have funding, and that whenever uh groups like Django Girls or et cetera apply for for grants that that we can meet those requirements or sorry, we can meet those requests, you know, it's it's not there to steer the actual technical direction of Django.

So it's something that like I declared whenever I was obviously joining DSF that I did work for MongoDB, I did work for a software um company, but there's no conflict because I don't have any say in the technical direction anyway.

Um so it's it's an interesting position to be in because I'm obviously a big fan of Django and it's a big part of my life and a big part of the community.

But in the company I work for, you can't currently use in Django in any meaningful way.

There's a couple of different packages that have tried to add Django support.

Uh the Django is probably the most popular one, which I think actually unfortunately doesn't work with Django 3, needs to be updated for that.

Um, I am hopeful with the changes coming down the line with Django async, that it's going to be easier for me to make the case going forward, that we should be applying a lot of our own kind of time internally to help and support Django.

Rather than looking at something that we could fund in the community, looking at something that we should be releasing ourselves and supporting ourselves.

Like um MongoDB has two different Python drivers and already a um a uh what do you call it a um ODM?

So instead of an ORM.

So an object uh document mapper rather than object relations mapper.

So we already have quite good Python support, but the way that they're looking at the moment is like, well, if Django wants support for uh Mongo, then they can use the existing ODM and and integrate that.

And it's where it's not what I'm saying is like, well, no, we should be trying to support that ourselves.

You know, that's if we want to if we want to have that first party support in in uh Django, then that's something that we need to step up and provide.

We can't just you know throw money at it or or any or wait for the community to

I mean, from a user's point of view, I guess what you want, right, is you want your Django models to just kind of I've already got my Django models, I've already got my Django project.

I want to just be able to save them to MongoDB.

I don't, you know, so I I kind of want a back end, but then there's going to be limitations in the the mismatch between the the relational model where you've got annotations and joins and I don't know what, and then the document model.

Um honestly, the kind of the big ones that people keep putting out is the advantage of document model is that it's like schemaless, you know.

So you wouldn't need something like migrations.

You would just uh make your changes to your models and and that would be fine, it would just work.

Um honestly that's well, yeah, it's an advantage and sometimes disadvantage.

Um really for me where I think MongoDB science is in things like it's an aggregation pipeline.

So the aggregation, so the aggregation pipeline allows you to apply basically data transformations and stages.

You know, so you might have a like a match stage, which is essentially like a select, you know, so find me all documents that match this query, but you might have a project stage which will allow you then to make modif modifications to each document.

You know, so you go, okay, well, I only want these four fields, or um, actually I want uh this field, but I don't want the value of it, I want the length of it, or I want to sum these two fields together and add this as an attribute onto my document.

And you can do incredible things with aggregation pipelines.

Uh so I'm using it at the minute.

I I did this talk at DjangoCon Europe where I spider like 10 million domains and then was trying to like just for the headers of what they returned, and then was interrogating that data set to try and find interesting things that were returned and being able to use aggregation pipelines.

I could do things like I could, so I had a dictionary of all the headers, I could convert that dictionary into an array where each uh item in the array was a dictionary itself with a uh key with a KV, or K being the dictionary key from the headers dictionary and V being the original value.

So I could start querying on that, and I could do things like you know work out um what the average number of headers were that were being returned per site, or what the the largest header returned was, or I could run um reg X's against the keys or the values to you know to look for, okay, so let's pull out what the oldest PHP version being used is, or let's look for lots of places had these like powered by or x powered by, you know, so let's try and group those together.

Um and all of that I can do in a single query using like an aggregation pipeline.

So is that dynamic?

You can also create views out of it.

Um so essentially it looks like a regular collection that you can query, but that's coming out of a pipeline, and that again that's that's live as well.

So it's really the aggregation pipelines is is the bit where I think MongoDB really adds value.

Um so just swapping out like the Django ORM for a MongoDB ODM, you're not gonna get the major advantage.

You know, just being able to have your data models there and query them as per normal, you know, there's this that's not where you're gonna see any big difference.

Okay, it's gonna probably be a bit easier for you not to worry about migrations.

And um, I personally find it easier to think of things as objects.

You know, so I have a you know, object-oriented programming, I have my class and I have my different attributes on that class, etc.

And then I don't need to worry about transforming that into a relational structure to put it in my database, I just send that to my database.

Uh, you know, I that kind of maps better for me.

It honestly took a while for it to click, but then once it did, you know, that's I don't need to worry about data structures anymore.

It's just like it's an object, and it's an object in my database, and it's an object in my Python code, and it's just an object, and I can just use it the same everywhere.

So those are key advantages, but you don't really get the full power until you also have support for the aggregation pipeline, and how we would get that into Django or what the interface of that would look like, um, that's a bit where I think needs a lot of careful consideration.

I mean, because naively I would assume JavaScript, I I worked with Meteor JS, which I think is still around, um, which we use Mongo.

Um, but what what's the lay of the land in terms of who's using MongoDB, in terms of frameworks and languages?

So mean is you had to you know draw a big i.

Um like the mean stack is still huge.

You know, so

I I don't know if the NSA is using Mongo, but they're using non-relational to make the haystack.

Um and essentially MongoDB IC isn't JSON, it's uh BSIN.

So it's slightly different, but um for for all intents and purposes, we can yeah, it's like JSON with more types, essentially.

So for JavaScript developers, it kind of makes sense to them.

You know, it's it's just a JSON everywhere.

You know, it's they just send a JSON to their database, it sends JSON back, and um they don't need to worry again about like uh doing any kind of transformations on on objects and stuff.

So it is really popular there.

Um I can't really talk an awful lot about individual clients with like clearing it with uh um the departments first, but we're what we're also seeing a lot of us in at the moment is we purchased Realm um about a year ago.

So Realm is it's an on-device database uh designed for mobile.

So you don't really need to worry about kind of reading or writing from the database.

You just uh get your object and then you you can use that in your code and it it manages the this the read and writes for you in the background.

Um what it also does is manages uh sync.

So you can set it up so it'll automatically sync to our cloud service.

Um and it'll do things like uh automatic conflict resolution for you as well.

So if you have multiple devices that are all connected to or all using the same RAM database, and one of them goes offline for a while, whenever it comes back online, then it'll automatically sync the data and resolve any conflicts that have happened uh since it's been offline.

Um we we for Hacktoberfest, which is coming up, we're working with a um a group called WildAid, and we built an app for them, which essentially WildAid is like uh wildlife conservation, and one of the areas that they do is they do a lot of ship inspections, so they'll board ships to ensure that they are you know they're not breaching any fishing licenses or any of that kind of stuff, that they're not in any kind of um breaches of wildlife regulations.

So whenever they're on board the ships, they don't really have internet connections, as you can imagine.

You know, they could be out in the middle of the ocean.

Um, so before what they were doing was they had you know paper forms that they would fill out whenever they boarded the ship, and in these paper forms they come back to the main office, normally very wet and smudged and everything else, and they would try their best to collate the information into like a database.

Now they have just an Android device that they take on the ship.

They fill in the form.

They can also pull down any of the information for the area before they go out.

So if they are expecting to see particular vessels or they know particular vessels in the area, they can get the most recent information about it and any any previous boarding reports and have that on their local device.

Do the boarding, take their photographs, make their notes, etc.

And then as soon as they get a connection, then that's automatically synced up with the main database.

So that's all open source.

Um, we actually built it in conjunction with them as part of MongoDB World, uh, which happened a few months ago.

It's now kind of they're they're using it like in the wilds where um there's more development needs done on it.

Obviously, there's additional features as there always are, so that's why we're we're making it our Hacktoberfest kind of project and looking for contributors there.

That's that whole realm of online except occasionally off, is is so interesting when you when you think about it.

Like because my my brother-in-law worked at a startup that was doing uh order delivery for restaurants where they have a device, they literally go in the cooler, which is just like a steel box.

Yeah, and they like he had to I think they're using flask for that, but they had to hump jump through all these hoops to deal with yeah, it just quitting out, even if they have Wi-Fi because they're going in this huge steel cage for orders.

Um, so just one example of many where you know that would solve a lot of problems to have a

Exactly.

We also were doing a uh demos.

Um it was a video streaming company, you know, so they produced their own videos that would be streamed in classrooms and schools, and it was all Django based.

And uh we had a big booth at a really yeah, um still is as well.

It's it was it's Twig T W I G.

So Twig World, I think is the Twigworld.

But they they do these short instructional videos for schools, kind of like three-minute long, you know, videos on science, biology, chemistry, physics, that kind of idea.

So it's a video streaming and quality of stream and lack of buffering was a big thing for us to be able to show at this conference.

So as anybody who's been to any big conference knows you can never rely on conference internet.

So the way we got around, yeah, doing the kind of online offline there was um we literally had a little server sitting on our booth at the conference that um was just serving up the media files.

So any anything large, you know, so like all the video files, image files, PDFs, all that kind of stuff.

And then we had a uh DNS, local DNS, that would resolve to that box for any requests.

So all of our demo machines, they would be running the web application online, but all of the large media, which was served behind like a static.twig world or videos.twig world, whatever it was, would be coming from the local network.

But also meant as well we were then able to offer a you know an open access point that other people coming to the booth could join.

And then if they wanted to watch it on their phones, they got the exact same experience.

You know, they were still getting these videos essentially like offline um at the conference.

Yeah, anyone who's had the I mean, I worked at an ed tech company and went to some demos, and it would have been nice to have had that.

Um that's just such a smart idea.

I guess you do it enough times and you're like, we need a better solution here for

So and this this was kind of just before containerization was really only just starting.

So with some of the bits that were starting to move across, um other bits weren't, and it was just it was a bit of a a nightmare, honestly, to try and get this deployed onto local machines and ensure that like all of the URLs were getting rooted correctly and stuff.

And um, yeah, we spent the entire time kind of being a little bit on edge.

So next year we were like, okay, we don't want to bring our entire stack down.

We're pretty confident that the in that the conference internet can handle at least fetching the HTML from you know the actual application code.

We just don't want to stream videos, and that was our our solution was like, okay, well, let'll just take the videos offline and keep everything else just running on the regular servers.

And it worked pretty well, to be honest.

If say I'm okay, I want to give I'm listening to the episode, I think I want to give Mongo a go.

What's my best way of um hosting it?

Like is it a cloud service like Mongo's a hosted for or should I spin up my own?

Because let me let me give you back I I I haven't used Mongo for quite a few years but when we did it a few years ago no no doubt it's all changed from then we had trouble with it was difficult to maintain and difficult to scale and it was hard work.

So what would you advise?

I don't know A, it's no doubt changed from then this was six years ago seven years ago but what would you say if I'm going to give it a go and I want to give it a play what should I spin up?

Like do not install it via like app get or any of the package managers.

They are all so far behind.

I think some of them are still running like 2.2 and we're now in 4-4.

You know it's it's ridiculous how far some of them behind and that and that's normally the the issues that we come across is people are still running really old versions of MongoDB you know and and yeah MongoDB like any technology had some TV problems at the start which are now all being sorted.

You know we still get people coming up oh but you don't have transactions.

It's like yeah we do it's fully asset compliant you know yes we didn't have transactions five years ago we have them now or that MongoDB is insecure it's like no MongoDB until you set up your uh like access controls until you set up your USNM etc your admin um user you can only access it from localhost you know it binds localhost and you cannot access access from anywhere else and I so you need to actually go in and configure it yourself to make it public

you know it's the the securities by the default security settings are a lot stricter than what they used to be.

And these are all things that if you're installing older versions of MongoDB of course you're still going to get the the the old issues that came with it.

So my first advice would be like don't install it from AppGet you know go and actually get the um the release directly from us.

The other thing is is watch Mark's talk.

So Mark Smith um Judy2K most people know him as on Twitter he's done a talk recently I think it was at EuroPython I'm not 100% sure on misconceptions about MongoDB.

So he runs through a lot of this kind of stuff about you know where you should install it from misconceptions people can have and yeah it's it gives a good kind of like for people even like ourselves and if we we join MongoDB you know we might not be completely up to date with it and you'll have these similar conceptions you have um Carlton about like what MongoDB is or was and that clears up a lot of them so I'd probably watch that first just to get some information on it.

If I'm setting up for myself now I just use Atlas.

So Atlas is MongoDB's um cloud kind of hosted managed service um it's it's got a free tier like a kind of you know free forever tier um it's you can deploy it to AWS Azure and somewhere else I think you know so you can try and keep your latency down by deploying it as close to where the rest of your infrastructure as possible but it's you know it's so simple to set up it's like button click

The only thing that I've I've had to um use any of the paid tiers for is the the the project summer earlier with uh DjangoCon Europe.

So I

So I had to um upgrade the size in that one.

I think it's costing like maybe like nine bucks a month or something like that.

So uh

I think their thing was called Atlas too or something similar because when I when I worked I remember when I worked to your point about switching to a non-relational database and just different frameworks when I worked on Meteor I'd already done Django for a couple years and I did that for a year and a half and then back to Django and it's yeah hosting databases was just boom built in they had all the auth stuff was built in it was kind of amazing just seeing a different spectrum of the customization um where you could be and at the time like I taught a class at a college with Meteor and we got bas

ically total beginners to build websites in a month like really dynamic websites.

So it's really and I think by looking back I think the biggest thing was it was just one click like install Meteor and it had Mongo in there and everything just kind of worked and then it was a hosted solution and this was yeah five years ago um like I wish when I think of Django and what trips people up beginners, you know, databases and and deployment is a big one.

There isn't the you know there's Heroku, there's Python anywhere there's a bunch of things but for a true beginner it's still quite a bit more challenging than JavaScript in a Mongo solution.

Yeah.

No agreeing just to play around in a different sandbox and see the choices they make and be like wow that has some advantages I mean maybe different things down the line but starting out um yeah it'd be amazing if Django had a hosted uh solution that just one clicked in.

I mean and you really don't is the thing right because you do default to local settings and you gotta update static and there's a whole bunch of things and and that has benefits but it there is a little cost for for beginners.

I remember the like first setting I on it and you would do your your kind of pip install in your Django admin start project and then you would try and you know run server and like none of your CSS would load.

You know you go to admin page it's just like just raw HTML you know you'd have to go and configure first of all it wouldn't serve any static files you'd have to have like cherry pie or something running to serve to serve the static files for you and there was no like collect static at that stage either and yeah um it's come a it's come a long way and become a lot easier.

So the work that's been done is phenomenal.

But yeah yeah it's it's still deploying Django is still uh difficult as well.

You know it's as you said there's no kind of one click um deployment.

Heroku used to have like their Django Heroku package but even that's being deprecated now.

I mean Heroku is still so that's the one I teach in my books just because they have a free tier and um if I tell you exactly what to do you can do it in five, six steps.

But if you try to navigate their docs, I don't think there's a lot of older things out there and people get tripped up.

I mean one thing and there's also environment variables which is another thing which you need for Heroku in most platforms.

Most platforms as a service should use anyways.

That's another one that really for beginners though there are a number of packages that make that a little bit easy easier.

And that was a big thing for me with the 3.1 updates I included my um beginners book is showing how to use environment variables which I was a little uneasy about but it's it makes settings files you know if you're gonna do any sort of actual deployment that isn't wildly insecure you have to use environment variables

100% and it's I it's actually a talk I gave recently at um PyCon Australia was like on how to

so easy just to hard code a secret.

Like even even experienced developers do it you know you're it's just a proof of concept or it's just a really quick hack and you're not quite sure that you're gonna keep this in here or you know you don't want to go freeze adding it to your key management store or whatever else so you just hard code it for a second and you're definitely going to take it out before you push your code up you know you know it's and then whatever happens you you forget about it or you you go away and make coffee, you come back your muscle memory kicks in you do a git push and suddenly your AWS keys or whatever

key is now up on GitHub and publicly available you know or even even if it's

So they they sort it they help you a little bit but it doesn't solve the problem if someone has access to your GitHub repo you know there's a hundred engineers.

Yeah.

Also right for security you don't you don't want them floating around.

You know you you've got to assume as soon as that's pushed up it's been compromised.

There's there's at least one or two websites which will generate a Django secret key.

But yeah totally I'm guilty of it.

And actually for me like I have repos of my stuff up there teaching where I have the secret key in and we swap it out and I GitHub regularly pings me being like you've got secret keys um which is nice that they do but a little annoying that I can't I guess I get unsubscribe.

Yeah everyone does it is to your point on the talk.

And I like that that that was a great talk too.

So you need to know how to how do I rotate keys you know how do we revoke keys what's the process for that you know how do we then go about reissuing them it's it's like any other kind of disaster recovery you need to you need you hope that doesn't happen but you need to plan for it to happen.

So you don't really have an admin user as such that can be exposed.

And so users register their own accounts and then well it's one way you can access it you can set it so register users can register their own accounts and then you can set like on databases or sorry on collections or even down to like field level what the access rights are that on our on that are.

So you can go okay well users can read all data that's in this this collection but they can only write or edit their own data.

You can set that at a database level so you don't need to worry about that that kind of business logic in your code.

So instead of like going okay I'm gonna do a a find and only give me back the documents that this person, that the off their ID is equal to their user ID you know you can just go okay give me all documents and I'm logged in as this user and it will automatically go okay well this user only has access to these documents and just return notes.

It's all done at the the kind of service level which is really nice.

Don't even need a server to run your queries.

see it.

Yeah I used to use that

I think this is the one but it's a yeah incredibly useful

as like which user and when they did it

Yeah we

Yeah um so I wanted to ask you as we're we're coming up on time you're I think so I first knew um saw you and came to know about you from your pip install talk and that's like the left hat problem from 2016 which fantastic talk.

I wonder if you could talk about that and I think you're you're planning an update to it right because it was a couple years ago.

isted.

So the talk really kind of was looking at it you know how you can really secure your installation process and your dependencies and things like the obvious stuff of around like penning dependencies but then also how you would run your your own local G Shop so your own uh local package index and a bunch of our stuff and honestly most of what I discussed in that talk is still relevant now you know not an awful lot has changed some of the we've kind of had sin

ce then there was a move towards um you know pep env and different package like package managers have kind of came and went during that time um but the the core of it you know uh pinning your packages checking package hashes to ensure they've not been uh modified from the the version thing you're installing how to run like your own local um repository all of that is still the same now as it was back then um but yeah I would

I'd love to expand upon it I think there's an awful lot around the Python ecosystem that can be quite difficult for people coming into it to start off with you know for your your very early users they really don't need to know an awful lot you know people okay we need to know virtual environments you need to know um about pynd you need to know um you know about uh uh environment variables and you need to know a bunch of our stuff and it's like well no really start off with you just need to have a Python executable and wr

ite some Python in a file and call the file you know that's your very basic hello world let's get people interested they can immediately see you know I put this input in I get this output out you know it's that instant gratification get them hooked on programming but once you kind of move into the more you know kind of intermediate level then where you're like okay well I I want to keep I've got several projects I'm working on I want to keep my um dependencies separate I might have a legacy project that's on a different version of Pyth

on than what I'm currently using for my own um more recent projects or you know I want to run Jupyter labs but I don't want to have a virtual environment for that it's all things then you're going okay well now we're gonna need like uh virtual environments that's fine that's Python 3 easy we've got those already but then you're looking at Pyenv so you've got like multiple Python versions um then you probably want to have like a virtual environment wrapper to make it a little bit easier to work with then you're looking at PipEx so you can run like Jup

yterLab so if I happen to install it and it's like okay well now we've got all this stuff how do we

I have like a Python local Python development environment that I'm pretty happy with it's taken me a couple years to get there but I've now got like everything set up that I I kind of like and I because I I do a lot of work with obviously different Python versions and different packages and things you know I can if I if needs be I can spin up a version of 2.7 you know um

, there's many different ways to do it and 100% and B, it's you're talking about path variables and it's non-trivial.

Let's give people all the choice.

Like everybody does have their own way of doing it and like mine won't be won't work for everybody.

I hope it works for some people um it's honestly pretty simplified.

I've I've really I went down the road of like having poetry and having multiple different uh kind of editors and plugins and everything else and now I really I I have my virtual environments I have pyenv and I have PipEx and that covers like 99% of my cases.

You know even the Pyenv is probably a little bit of overkill to be honest.

I think the only time recently I've had to install an older version of Python was actually to do a node installation where one of the packages was uh assuming you had Python 2 installed instead of Python 3, it was still using the old print statement.

So the which was interesting that I needed to have a particular version of Python installed in order to do an NPM install.

Because obviously web uh programming is not confusing enough for beginners.

It's like you need Python too.

I'm like, what?

Don't do this to me.

It was like, okay, I could I can try and take these dependencies out, or I can, you know there's people were posting like fixes in that you could go and modify the the the module yourself in order to get the work with three because it really was a very small change.

You know, they were just calling the print statement in the Python 2 way instead of like calling the print function in Python 3.

Um, but it was like, well, I have PyNV here.

You know, I can just install 2.7, you know, make that the the Python interpreter for this particular shell session, do my installation, and then you know, not have to use it again.

Job's done.

Like if you're teaching, you can use Replit, you can use Glitch.

Um and I believe that VS Code is working towards this if they don't sort of having this where you know in five years people look at us and go, well, you just log in and it's sort of a virtualized, it's like Docker in the cloud.

So you don't even have to deal with this nonsense.

I think I'm not exactly sure where VS Code is at with this, but in terms of beginners, like I think they're pretty close in terms of having it all you know, like your own Docker spin-up so you can just download, you know, use VS Code and then everything is in the cloud, you don't have to worry about versions.

Um that's sort of like game set match that solves a lot of these problems.

I mean it doesn't solve the fundamental ones in Python per se, but if it's uh hosted, you know, sort of like Docker for newbies.

And I think I'm pretty sure VS Code is working on that if they don't already have it.

Yeah, GitHub too.

I managed to get it, but that's all part of the same deal, right?

It like it fires up you know a containerized environment, and you just open up VS Code and you do this remote, open this remote thing, and it opens your VS Code, and it's just working.

And yeah, you know, if you've got decent internet, it's you know it's indistinguishable from you know local development.

From a business perspective, when you're containerizing things, there's much more of a cost to hosting than you know JavaScript or static files.

So it's the type of thing that as a startup scales with virtualized things, you know, their costs are gonna keep going up.

It's a little bit easier for Microsoft to eat the cost of that long term.

Um I think glitch has even explicitly said they're I think it's still basically all free.

They're gonna grow it out and then do something with it.

But but anyways, there's there's some additional costs in the back end, but yeah, those things

come down.

And then you know it's okay, well, click this button to deploy it as your brainer.

Exactly that.

I mean, you can see all the pieces lining up.

Well, so we're at um 50 odd minutes.

Is there anything you want to mention that we haven't?

Any anything else you want to plug personally or professionally?

Uh I would love to hear other people would like to see that as well.

The more people I have uh kind of asking for it and the better business case I can bring to my employers, uh that's obviously what be helpful.

So if you would love to use MongoDB with Django, you know, or if you're already using MongoDB for something else alongside Django and you'd like to see integration between the two, or you have a particular use case that you think would be compelling, then please do reach out.

You know, you can either contact me um via the DSF uh by email or you can contact me on Twitter.

My DMs are open.

I would love to hear what people's kind of what their wants are, uh what their use cases are, you know, any anything I can I can help to build this case to to bring MongoDB to Django would be really useful.

Um I guess in a way separate from Django developers, I know there's not that's the main place where things are happening, but more of a generic area to ask these kind of questions.

I don't know.

Does that make sense, Carlton, or is that crossing wire?

It's uh the the sort of I whenever anyone mentions new features, I get this massive sort of ice thing down the back of my neck because I'm like, uh how on earth is this ever going to happen?

Yes, but you know, over time we seem to keep rolling out new features.

You know, I would still see it as something that would be a package that you installed like channels.

Um we we have the ability to do that now that the the kind of database engines and stuff are um easier to to swap out.

So yeah, I'm again it's it's not even something that that a company could try and do because that then the final decision about what would make it into Django is up to technical board, you know.

So there would need to be a very compelling reason for them to want to add it into the core.

And I I don't think that's going to be there, not for very long time.

But um, I would love to see it supported as a package that could be installed alongside Django.

Yeah, South Migrations was a third-party package, right?

You know.

It's a nice shirt.

I like that shirt.

Yeah, good, good, good.

But if we could somehow take the model classes and then leak that map to a document model somehow, then you you know, then you would query the document model.

But if you didn't have to duplicate, that's the trouble when you switch.

Like, you know, if you the same with uh I know you can put your models into Elasticsearch, you have to create an Elasticsearch document, which then and it's like it's kind of really similar.

It's like, can I get could I somehow automate this from my Django model to the Mongo document model so that I didn't have to type that out twice?

That would be amazing, and didn't have to update it each time, you know.

It's typing it once is fine, but oh, I've made an edit here, now I need to make a match and edit over there.

That's a pain.

So you've got your your ORM, or in this case it'd be like your um ODM, and that's gonna be how you interact your data like 99% of the time.

Yeah, but then if you want to do something you know uh more bespoke or more complex, then it'll be like an MQ object, you know, which you can then use to create your aggregation pipeline or you know run any of the very specific kind of MongoDB type queries, you know.

It's um you want it as far as possible to be something that you can just swap into a project, and if you're not doing anything you know weird or wonderful, then it just works as the regular Django RM would.

But if you want to use some of the features of MongoDB, then you're you're then dropping into a different kind of um interface to that, and you're very aware that you know this is now MongoDB specific.

You know, I will not be able to move this project easily from MongoDB back to Postgres or to SQLite or to whatever else, you know.

Uh for similar reason, but if like if you're writing raw SQL queries and you're maybe using some of the features of Postgres that's not supported by SQLite, you know, so you know you're you can't just easily use that in development and then Postgres in production.

But it has to be that for me anyway, there has to be that kind of separation, you know, so that people are are very aware of when they're doing something that is specific to that particular database.

Cool, super.

Agreed.

I'm excited.

So thank you for coming on.

It's been a lot of fun.

I've been enjoying it.

The next fortnight?

In a fortnight.

A fortnight.

Okay.

We'll see you in a fortnight.

Bye-bye.

Bye-bye.

Bye, folks.