← Back to Show Notes

Transcript: Python Infrastructure - Ee Durbin

Carlton Gibson

Hi, welcome to another episode of Django Chat, a fortnightly podcast on the Django Web Framework.

I'm Carlton Gibson, joined as ever by Will Vinson.

Hello, Will.

Hi, Carlton.

Carlton Gibson

Hello, Will.

He's here.

And this week we've got a special guest, E.

Durbin.

Hello, E.

Ee Durbin

Oh, it's it's very good to be here.

Good to have you.

Carlton Gibson

So E, I've I'm almost lost to words to how to introduce you because you're kind of like a you're one of these figures in the in the Python community that I've seen and been like, you know, major major cornerstone of everything that goes on.

So that's I'm almost blasting.

Will Vincent

So infrastructure at Python, right?

That's the quick take.

Will Vincent

So that means PyPI, Python.org, we'll get into all that.

That's a lot of what you do pretty much well, not you could you tell us how single-handedly that is, but my sense is you drive a lot of that.

And that's that's truly internet scale.

We often joke about Django and sites trying to do things internet scale, but you know, running PyPI, for example, that is truly internet scale.

Ee Durbin

Yeah, well, I I I am it is it is a portion of my full-time job, um, and that is supporting, you know, a a pretty large swath of volunteers that that are also take part.

But yeah, we do uh there are th there are three people who are really, really, really actively involved in PyPI itself.

So it is it does end up backstopping on me, uh, you know, occasionally.

Will Vincent

Well, very modest of you.

Yeah, Carl Carlton, sort of like you with Django and releases.

Carlton Gibson

No, no, that that's Marius in releases.

He's uh you know, he's the backstop.

Will Vincent

Yeah, we're we're recording this the day Django 3.2 came out.

Um, so that's

the I saw by the way.

Ee Durbin

Congratulations.

Carlton Gibson

Yeah, thanks.

Will Vincent

Yeah, I see it's Hacker News, you know, they had their annual, oh Django's exists and it's cool.

And I

Carlton Gibson

fooled it posted the comments on that thread.

And it was you know, the first comment, a couple of comments, and then you get into oh, you know, I like Flask, and then it's like, no, you mustn't use Flask, you must use this.

Will Vincent

It starts with microframeworks, and then you get into JavaScript is better, and then you get into Rust.

Carlton Gibson

And it's like, why did I look at the comments?

Ee Durbin

I'm very lucky to have uh friends who look at that website for me and help me know what I need to actually go and and read.

So I try to stay away.

Will Vincent

Oh, Ditto, I I don't have an account anymore.

I I only glance once a week now at this point.

It is it sort of I mean that goes for social media for me in general too.

I've pulled away because I take a glance, but and that feels okay, but anything more than a couple minutes and it's not good.

Ee Durbin

Yeah, once in a while there's a there's something posted there that actually gets any amount of praise.

And most recently it was it was actually related to PyPI, and it was when we rolled out the uh implementation of their token token scanning.

So basically, if if you accidentally upload one of your API tokens to GitHub, uh PyPI will now revoke it almost immediately.

Um and the people on Hacker News seem to like that.

So it was it was oddly satisfying to see PyPI and not uh something relating to all manner of of angry thoughts.

Carlton Gibson

So I've got this terrible thing come across now because when I was uploading Django 3.2 today and I, you know, um twine upload and it goes up and it's like legacy dot something.

I'm like, I've got to update a setting somewhere.

I'm now I've got you in front of me, I'm gonna be like, how can you open up my config and help me sort it out?

Ee Durbin

I I'm hoping that was probably uh twine or setup tools, whatever using to upload.

Um But it was say it was using the legacy endpoint, and I must go into the you know the docs and find the you know, find the what's the the what URL string do I need to change to get it to use the the latest one?

Carlton Gibson

Because otherwise it's

Ee Durbin

actually the same it uh it's actually the same implementation.

So the reason that warning is there is so that eventually when we do change the implementation, um we can use a different URL.

Um so at at the very least, you're not missing out on any features.

Um you're just talking to the wrong URL.

Carlton Gibson

Yeah, well that's fine.

I I think uh I my my feeling at the time was or or A, I must address that, but B, if it was serious, it would be in a different color.

Ee Durbin

If it was serious, it would just give you an error and say, it's too late.

Uh you've waited too long.

Carlton Gibson

Yeah.

I'll fix it then.

Will Vincent

So a lot of podcasts don't go deep on technical stuff, but since the three of us who we are, I really want to do that today.

But maybe could we quickly get your your backstory?

So, how does one get to this position with the Python organization?

You were telling us you're based in Cleveland.

I believe you you went to school there.

Are you from there as well originally?

Ee Durbin

I grew up in Southwest Ohio and I came to Cleveland for school, and then I briefly uh moved to San Diego uh after school because it was one of the only jobs I could find that would help me pay for those uh dastardly student loans.

Um but I went to school for physics and math and graduated into a recession um that we're all pretty familiar with.

Um and uh the junkyard job that I had for the first like six months after I graduated wasn't paying for things, and I took a job with uh an appraisal management company, and I was just supposed to do like magical spreadsheet things for like their business reporting.

Um, because you know, physics and math, yeah.

Um, I wasn't very good at it, and uh pretty quickly ended up just just through you know hobby type interactions with computers over the years and just being decent with configuring them and such, I ended up sort of a sysadmin for you know sort of a standard cubicle farm type thing.

Um, and that company had like an in-house uh programming startup that was doing uh a pretty neat piece of software.

And so the lead for that looked, it means that you went to school for physics and math?

I said yes.

Ee Durbin

Uh and so Kanan said, well, that you can learn PHP.

Um so we'll just go ahead and have you start programming with us uh since you're kind of done with automating all the workstations and stuff.

And my the first time I ever wrote Python was at that job, and it was because I searched for how to programmatically access stored procedures from a MySQL database.

And lo and behold, I ended up on PyPI looking at the MySQL library, and I was like, this is the first thing I found that can connect to MySQL, I might as well use it, and um that's when I wrote Python for the first time.

So I eventually desperately wanted to come back to Cleveland.

Ee Durbin

Um I got a job here doing sort of Linux sysadmin type things, um, you know, and continuing to write Python to automate stuff.

And through a local community and like the local Python user group, um, I was introduced to an opportunity um to volunteer, or I'm sorry, to do part-time work um as a sysadmin for the PSF.

Um, I took that part-time job, and that's how I got introduced to like, you know, PyPI and python.org and such.

Um, pretty much immediately quit billing um and like submitted almost no invoices um and and pretty quickly turned into mostly just a volunteer at the infrastructure and did that for you know a number of years.

And you know, that is really to me uh how I got introduced to so many people in the community.

Um is you know, I was volunteering on the infrastructure, which covers you know all manner of technical concerns for the community as well as community concerns.

Um, you know, so I would interact with the PyCon staff uh for to help get the PyCon site going and things like that.

Um and then just kept at it.

And I mean there's there's a ton of wonderful people that you know all have a pretty common direction and goal.

Um and they tend to be kind and the community shows a lot of what's in my opinion, the the the best of the software industry, or at least aspires to it.

Um and so I kept kept on with that.

And then years later there became an opportunity uh and I was offered a job at the PSF to take on uh the infrastructure role, and I've been there.

I've been here, I guess, for it's it's either two or three years, and I should probably know.

Uh it would be yeah, it'll be three years, three years in June.

Will Vincent

Wow.

We had uh Eva on last week to talk about her own progression from part-time to full-time and and sort of that side of things.

It it's sort of wild to think that the PSF was ever small, because in you know Django Land, the Django Software Foundation, we look at Python and Python Software Foundation as this Godzilla of a thing, but that's really pretty recent that outgrew the volunteer realm.

Ee Durbin

And yeah, I mean, I I I I I personally remember when the PSF really was just sort of Eva as far as full-time roles go.

Um and so it it has been interesting myself to watch it grow.

And then, you know, we just we just had a new a new person start recently.

And so, you know, my eyes light up because I'm learning so much about you know the community and nonprofit operations side of things, if you will.

So, you know, I I am community-oriented in a lot of ways, but not necessarily in the way that the PSF is.

And so it's been it's been a a really amazing opportunity to stretch my legs a little bit outside of just sort of sitting at a keyboard and pounding my head against it occasionally.

And sometimes it's you, you know, you actually get to talk to people or um you know interact with the community in a way that is not just via software and it's been very rewarding.

Will Vincent

And you have these office hours where you've had them, because I think we first spoke two years ago or something like that when I was setting up a site, and uh Jeff Triplett recommended I get in touch with you around python.org, which is a Django site.

And that was I so I guess my question is do you still do that?

Is that that's something you did a lot of?

Because it was very generous of you to just have open office hours.

The office

Ee Durbin

hours were um initiated during my time as the PyCon chair.

Um, and so this was before I was a PSF staff member.

Um, you know, as I was and I was also a volunteer um chairing PyCon.

And a big aspect of that is, you know, I I recognize the you know the position that PyCon has in the community, um, but I also personally very much recognize the immense value in re regional organizing.

Um and so the office hours were a really good opportunity for me to provide, you know, that that low intensity space to meet a lot of folks from you know different regions and different parts of the community that that sometimes can't even make it to PyCon in person.

Um, I kept doing them for a while.

Um, and that I I I think I took it down uh about a year ago um as the stress of the current world circumstances uh just became a little bit much for me.

So it's actually I appreciate the reminder because it's something I probably in a much better place to put put back into into service.

Carlton Gibson

It it's something I've been thinking of actually, because I saw Son Wilson said he does he's doing office hours for his dataset project, and he's like, I really recommend this.

I was thinking, well, maybe I could squeeze one.

How did you run it?

Did you do did you um just like have a a video call or did people book a meeting or did they

Ee Durbin

I used a service that allowed um for integration from my calendar to a set of slots that I'd predetermined to

Will Vincent

be like Yeah, I think it was was it Calendly, or that's one of those.

Yeah, it's one of those ones.

Ee Durbin

Yeah, I just I just typically plug brand names, but yeah, it was Calendly.

Um yeah, and and and then I had that.

Will Vincent

That's how you do it, Carlton.

Yeah, you just say this is when, and then someone and I I assume actually, I don't know, on your end, can you sort of say no, like what's the last minute someone can do it, right?

Like there must be some sort of

Ee Durbin

Yeah, you can tell it like you you can you can only schedule 24 hours or seven days or whatever in advance.

And then my favorite part is that you can say don't allow for somebody to book like within 15 minutes of a previous thing ending or before another thing.

So it's really nice because you just open up the the little windows and uh windows of time, and then it just sort of takes care of the rest, and you'll just get an email when somebody books it and it shows up in your calendar, and you know, it's cool.

I I I I do recommend uh you know some automation around it because otherwise you're you'd be doing something you'd be doing a lot of work uh to offer that up and it would become probably more stressful than it's worth.

Will Vincent

It's it's so funny that it it works, I think, really well in a nonprofit or in a volunteer setting, but on the business side, I've I've had it used on the business side, and there it becomes more of a it's totally a power move.

It's like who's gonna set who, you know, someone will ask something, ask for a meeting, and they're like, here's my dates.

And it's it so it's so nice actually when it's just like, okay, like you want something for me, like here's my calendar.

It's so much simpler than in the NBA world, which I spent some time in, it it sort of weirdly becomes this pissing match of sorts.

So it's nice to hear that it doesn't have to be like that.

I just have some scar tissue around.

I as soon as someone would send me one, I was like, what?

Ee Durbin

Uh there were a few times where people would schedule to try to sell me things um or convince me to do weird thing, weird stuff, but like you just you just hang up on the call and you go you go on with your pay.

One click.

Oh, is it most well right?

Will Vincent

Well, so can you uh talk about then the so what is the scope of infrastructure?

So I've I guess to me, I know PyPI, python.org, but but there's more than that.

What how do you define it and and then in terms of what takes up your time?

Sure.

So the

Ee Durbin

the PSF operates infrastructure both uh for the community, um, and so that would be a lot of the public-facing stuff like python.org and pypi and the wiki and the pycon site and and such.

Um we also operate some infrastructure for our own operations, um, so you know, so internal sites for membership data and and and and things like that.

Um, and then we also in the last few years have been either providing um infrastructure or collaborating or supporting infrastructure for our fiscal sponsorees.

So the PSF uh recently took on the ability for organizations who aren't quite big enough to be at their own nonprofit, um, but need that structure around you know the tax incentives and such to apply to be fiscal sponsorees.

Um and so we have a couple of those.

Uh, like the most recent one is the Python Package Authority, uh, is the most recent fiscal sponsory.

Uh, and that allows that will allow them to you know do fundraising uh in a in a in a nonprofit sort of way.

And we've already been supporting the PyPA infrastructures that things like packaging.python.org and uh such.

So it's realistically um you know almost everything online on the python.org domain, um, as well as uh PyPI and and a few other things.

So it oh, and then like really mundane things like uh who holds the registration for a given domain.

So the PSF, you know, we make sure that these domains remain registered and that there are funds to renew them uh for a number of organ, you know, a number of smaller projects and things.

Will Vincent

That all sounds very familiar.

Ee Durbin

Yeah.

Uh you know, I I guess the the less than glamorous way to describe it is, you know, the the PSF infrastructure is realistically here to make sure that the really boring, mundane things do get done.

Um and you know, occasionally, and it's exciting, always of course, uh there are opportunities to to build out new things or improve or you know, rebuild uh existing stuff.

Uh, but there's a lot of running around to do to make sure that TLS certificates remain uh valid and uh such.

Will Vincent

And with volunteers especially, right?

I mean, we have that with Jang, you know, Django Cons, not to mention other things.

There's you know quite a bit of that at the board level, yeah, Carlton level.

Carlton Gibson

So but the the ops team, you know, it it's so there's Maris and I who are you know we're contracted, but the the rest of it's all volunteers and you know they're busy rebuilding servers, you know, on the weekend and all the rest of it, and it's like you know

Will Vincent

amazing that it works.

Um, you know, it's sort of a bunch of people who you know swoop in when they need to, and then hopefully otherwise can kind of I mean they all have you know they don't get paid for it, so right.

Ee Durbin

Yeah, and so there's a lot of that too.

So facilitating uh various working groups, you know, a really active one is the documentation working group, so docs.python.org.

You know, there's a lot going on behind the scenes there.

Um, and you know, realistically, you know, it's my responsibility if infrastructure concerns of that have a problem.

So whether it's the places where the code runs and and such, but you know, it is volunteers that are push they basically all the forward progress that's visible is is driven by volunteers most of the time.

And then uh the infrastructure is ideally the thing that no one else is worried about um unless they want to be.

Will Vincent

Well, there's also there's the you know technical infrastructure, and then as you were saying, just the infrastructure of a nonprofit or a community thing.

I mean, we we spoke obviously a lot with Eva about that, but so much of that is people don't think about in terms of I mean, she mentioned you know, going out for grants and Python is built the PSF is building up the the capability to support those properly.

I mean, those are things we can't do right now.

And even the fundraising, Carlton spent quite a bit of time updating our because Stripe changed their their end of things, you know, donations to Django.

It's been interesting to see um GitHub sponsors.

You know, GitHub is I'm sure by the time this launches, they're gonna have uh corporate sponsors as well.

So they're making a big push there.

And on the one hand, it's great because that's no easy thing to manage all that.

Um, but if it's Microsoft managing every nonprofit in the tech space, there's I suppose some concerns as well.

But that the demands are real and largely behind the scenes around both sides of the tech side, and then just running a nonprofit with software.

Ee Durbin

Yeah, and then there's keeping track of all the various ways that you know contributions come in.

Uh, and so that's where you know the the the accounting team at the PSF has a a lot of work to do because you know, GitHub sponsors sound so good on paper from a I want to give money perspective, uh, and it sounds so good from a I want to receive money perspective, but then there's the aspect of oh wait, but that's a whole nother reporting pipeline for contributions and such.

So yeah, I the the infrastructure aspects, like the the the the non-technical infrastructure aspects are yeah, I mean there's just a number of systems and all sorts of things going on, and there's no one one there's no there's I I guess there probably is there's like QuickBooks for accounting that takes care of all of that.

That's where it all ends up, but it's getting there, right?

Will Vincent

But I mean, yeah, it's just it's non-trivial.

I mean, there's that's why you you all have th three accountants.

Carlton, you were gonna say something.

Carlton Gibson

I was just gonna say on the GitHub front, uh you know, thinking so I'm um based in Europe and I'm um in Spain called uh my status is autonomous, like it's self-employed basically.

It's um you know, a particular type of tax setup.

But in order to have GitHub sponsors, I'd need to be able to um identify the payers and whether they'd have to have a tax number and all of these things.

And it's it none of that's available.

And it's like so literally, I can't accept GitHub sponsorship money without breaking the the you know the European and Spanish tax laws.

And it's it's like so it's it's a nice idea, but the reality is it's not compatible with you know, yeah.

Ee Durbin

Moving money internationally is difficult, that's for sure.

Um, you know, we've we've been really lucky.

You you mentioned them earlier, but we've been really lucky to facilitate a number of grants um for improvements, and you know, contracting uh the people who are most apt to do the work has meant you know, international uh contractors, and that in and of itself uh is a is an amazing uh web uh of nonsense to cut through.

Will Vincent

So well, we I mean to you know, so there's two Django fellows, Carlton and Marius, and each of them gets paid a different way in a different form manually.

Um so I can we can only imagine the scale Python's at.

Will Vincent

I hadn't I didn't think about the spit that sponsors thing, Carlton.

That's that's so you can't what if so you you can't accept I don't know what's an equivalent of those like buy me a coffee thing.

You couldn't do one of those.

Carlton Gibson

Maybe you can if you've got if they've got the right um collection.

So you could set the way you end up doing it is to set up a stripe payment thing and you make that you just get them to put in their actual details and they can do it there.

But like these services where they might try and make it easy, unless they're collecting the right um um data, or they act as the seller of record, I think it's called, like the you know, so the Yeah, like Gumroad does that.

Carlton Gibson

Yeah, yeah.

So Gumroad, you're s you put Gumroad are the are the people doing the payment, and you just they pay you a royalty, and so that's fine, you can use do that.

But if they're paying you directly, you have to collect all these details and you know.

Will Vincent

Well, I don't yeah, nothing.

This is this is general but I mean I think that that stuff is you know, Stripe's improving what it automatically handles around taxes and all the rest.

I mean, it's a slow process.

It's also the case that with sales tax, like on books, for example, a lot of times or digital goods, the rules only apply if you're at like a six-figure or above level.

I mean, they they recognize that it's impossible to enforce.

So, you know, the United States in the United States, you could argue that every state tries to get their hands on a digital transaction in some way, but you know, it's basically I mean, I spent quite a bit of time trying to figure this out.

There's whole services that will calculate online sales tax um for you, and it it it's impossible to do.

Um but it's largely you know only for transactions.

I believe it's generally high six, seven figures before they even say you're supposed to try to do these things because it's no, you know, nobody can.

But anyways, it's a real concern.

It's difficult, right?

Try to stay trying to stay away from it, yeah.

Carlton Gibson

Yeah, so so E, I wanted to talk about um PyPI, right?

So I go pip install Django and it goes and fetches it.

And how on earth does that work?

Because there's a not like you know, I know there's a server and it serves the files, but I mean, you know, in terms of that works reliably for how many people per day, and you know, how has that grown up?

Ee Durbin

And now this is this is a place where I'm always happy to plug.

Um realistically, PyPI uh exists as reliably as it does because of Fastly, our CDN provider.

Um Fastly is extremely generous in the the amount of traffic that they handle for us.

So this is on the petabyte scale per month now.

Um and so you know PyPI's backends are by no means um small, uh, but relative to the amount of traffic we do at the edge, they are they are minuscule.

So for 90 97 plus percent of pip interactions with with with with PyPI, you are probably getting receiving a page from the simple index from Fastly, and then receiving like in their cache, and then receiving the actual file itself, especially for a project like Django from the cache at the edge.

Um behind the scenes, uh you know, we're we're also really fortunate to have amazing infrastructure support from Amazon Web Services and Google Cloud platform.

So the the file, the files themselves are stored in Google Cloud objects, um, access logs and not necessarily access logs, I guess.

A better way to put that is uh access statistics are stored in Google BigQuery.

Um so you can go find out all sorts of amazing stuff about who's been downloading Django from BigQuery now.

Carlton Gibson

Um and that's accurate because a few a couple of years ago I remembered trying to look into this, and there were this the data wasn't really available.

Ee Durbin

It's been it's been improved dramatically from work by Donald Stuft Um and uh Dustin Ingram uh in Line Hall is the project.

And so that takes the actual access logs from the files as well as access logs from the simple index and converts them into anonymized um records in BigQuery that are as accurate as we can possibly imagine.

Carlton Gibson

Um and that's aggregating from the edges from the CDN.

Okay, that's fantastic.

Yeah, so simple simple index access is probably the most accurate because uh you have to talk to that.

Ee Durbin

Uh with the in with the advent of pip caching, uh the actual file downloads have been minimized some somewhat.

Um but yeah, there that so you can read more about that at packaging.python.org if you search for like uh PyPI uh access or PyPI usage statistics or something.

Will Vincent

Um I'll find it and put it in the show notes.

I I'm I think I I've seen that article before.

Yeah, and then we have like

Ee Durbin

I don't know, uh 12 to 15 decently sized DC2 instances um running uh Kubernetes uh in Amazon that run uh like a handful of services that compose PyPI.

So there's like the main one, which is the web app that you see and interact with.

Um and then we also have um the application that handles like uh turning or enforcing TLS for all images that are accessed, and then we have another service that does um uh URL magic, I guess.

I don't know how to describe it.

Ee Durbin

It it makes URLs work if you try to access a URL for a package file um in a way that's uh sort of uh outdated.

Will Vincent

So there's probably a dictionary of some kind to match those up.

Ee Durbin

It's uh so it's a C conveyor does it it also serves those old like docs.pythonhosted.org.

Um and then it turns the the way that PyPI files used to be stored were like slash capital or slash first letter slash project name slash and then a bunch of files.

And so you used to be able to reliably say, like, I want to go get this file.

I don't even know its name, but I know that it's the project at this version.

And so you just guess.

Um because of the scale of PyPI, that that that had to change because like S3 buckets and Google Cloud buckets and stuff don't deal with these like these these these sorts of or didn't used to deal with these sorts of bio file hierarchies.

So now it's like slash packages slash like a bunch of hash gibberish and then the actual package itself.

Um and so that, you know, you you kind of want people to be able to access the file the way they used to.

So conveyor exists for that purpose as well.

Um yeah, and then we we use pretty we we we try to maintain I I think a big reason why PyPI has done as well as it has growing is right off the bat fastly, that takes a lot of problems off of our shoulders um as far as just the the the sheer volume.

Um and then otherwise we've made really boring choices around technology uh for how to get to where we are.

And so we're still just using, you know, a moderate, moderately powerful Postgres instance and some Redis and you know uh unfortunately not Django, uh, but a very Django-inspired implementation of Pyramid.

Um Donald has often said that he accidentally built like you know a bunch of what he knew from Django into warehouse to make Pyramid work more like Django.

Um so yeah, it it it and then just G Unicorn and Nginx and just sort of all works.

Um we've done a lot of learning on how to push uh what's there uh to to this scale as well, and you know things break and they'll always continue to break.

But simple choices and trying to keep trying to keep our footprint small.

Will Vincent

Can you talk about the growth?

I mean, I maybe it's in that where you referenced I've seen the charts of you know just downloads from PyPI in the last couple of years, and it's almost exponential.

Carlton Gibson

And how much of that is CI?

Is it is it PPI?

Will Vincent

Yeah, that's Carlton's thing.

Yeah.

Carlton Gibson

No, but e is is Python that much more popular because it is much more popular?

Or is it like, you know, that we're all running 58 GitHub action jobs every time we get it?

Ee Durbin

Yeah, I I'm not, I'm not, I guess I I've never I've never seen an analysis and I've never like been able to perform an analysis to pinpoint one thing.

Um and it also depends on what we what we talk about when we talk about growth.

So if we just look at requests to the service, or if we just look at bandwidth, or if we just look at number of projects and stuff, you know, there's sort of different axes, right?

Um when it comes to bandwidth, our biggest bandwidth growth has been in data science and machine learning um projects and the binary wheels that support you know computing on GPUs, right?

Like that's contributed massively to our bandwidth.

Um when we look at requests, I would assume that like requests to the service, a lot of that is driven by CI, you know, of course.

Um some of the bandwidth probably is because caching in CI is an unsolved problem, it would seem.

Um then, you know, what one of my favorite one of my favorite metrics to look at is new project registration.

Um and so, you know, we that that that growth I think is probably the closest you could get to the popularity of the language, right?

So the the more people are publishing new and novel projects, um the more the I think that that that that shows a healthy ecosystem.

Um so you know that that growth has been pretty steady, all things considered, and accelerated significantly due to like code generation things, right?

You know, so you know, some some people like their one their one repository might create hundreds of sub-projects, right?

But that's that's not super common.

Um yeah, and but yeah, I think data science and machine learning have been uh you know the most obvious growth aspect for for both Python and PyPI in my in my assessment.

Carlton Gibson

Okay, and uh talking about registering new projects, one thing that was crossing my mind in the last week or so was about namespaces and like the sort of name collisions on PyPI.

Is that is that a big issue?

Or is there moves in the ground to because a lot take for instance the Swift ecosystem where they they they do it by URLs?

So if you've got your your your repo URL, it's you it's namespace per user kind of thing.

Sure.

Ee Durbin

So I it it's it the namespace issue has a couple of implications.

Um as far as like when I hear that when I hear that when I hear that word, it's like it's it's ringing some bells and turning some lights on.

Um so one of the most recent conversations on namespacing has been around some of the you know the published uh I don't know if you are did did did either of you see the article about like dependency confusion?

Carlton Gibson

Yeah, the the there was a thing about poisoning dependencies and packages which perhaps were malicious, named very similar to existing packages.

Ee Durbin

So yeah, or or named precisely like an internal package that isn't actually published at the index.

Carlton Gibson

Oh yes.

Yeah.

Ee Durbin

So you know, then the name as uh it's it's interesting because you see these wonderfully named projects pop up on the index, and you're like, that wasn't taken?

How?

Um so you know, we're we're working with arbitrary length strings of characters, and so the the human mind will always come up with uh things like you know to to to fill out that that that that space, I think.

Um so from from like exhausting the list of usable names on PyPI, I don't think namespacing is necessarily a big concern.

But on these other aspects of uh you know provenance of a of a project, validity of a project, um and and safely managing installations at clients, I think namespacing has a lot, a lot of opportunity to help ease some of these these concerns.

And it is something that you know we're we there's the there's an open issue on the on the GitHub tracker for it, and it's something that you know we're really interested in pursuing and are hoping to be able to do so, you know, rather soon.

Um, so there's some really exciting announcements uh that that do pertain to PyPI and packaging that that are going to be coming through, I think probably in the next week or so.

Um so I would definitely recommend checking out the Python Software Foundation blog at python.blogspot.com.

Will Vincent

Yeah, I think Eva hinted at those as well.

So um in fact, I think it'll be out by the time this airs, so I'll put a link to the the the PyPI news.

Ee Durbin

Awesome.

So uh, you know, I think with with with with time we'll see a lot of these things develop, and we're really excited to have the chance to to pursue like things of that scale.

Uh that's a that's a rather big change to the ecosystem.

That's a rather big change to the service.

Um but we're excited the opportunity to be able to pursue those more consistently.

So PyPI itself has seen a large amount of investment over the years.

Um, you know, uh Mozilla funded, I'm sorry, Mozilla Foundation funded funded um the launch of the rewrite of PyPI.

Um Open Technology Fund uh funded some really big security improvements and user experience and internationalization improvements to PyPI.

Um the Chan Zuckerberg Initiative and Mozilla again funded a bunch of work on PIP last year.

Um but those as as amazing as the outcomes are, um, it does stink because it's just like we get all of this done, and then there's no more money, or there's no more, like there's no more roadmap for what's to what's to be done next.

And so people sort of disperse back to what they were doing.

Um but we're hoping

Will Vincent

right the maintenance is less fun than the ever you know the greenfield.

Sure.

Ee Durbin

So we're we're really excited to to hopefully have you know improvements on that story, not just for PyPI, but for Python packaging more generally soon.

Carlton Gibson

Yeah, I mean it's hard to create a roadmap when it's like you know, there's this there's well, there's a bit of a there's a you know a bit of momentum here, and then okay, well that's finished, what do we do?

Oh yeah, as you say, wander off and go back to what you're doing.

Ee Durbin

Yeah, and it's not common that somebody just sits down and says, I want to go through a months-long project as a volunteer to add a feature to a service, right?

Um that's a that's a huge commitment as a volunteer.

Yeah.

Will Vincent

Yeah.

So you mentioned pip.

I wanted to ask you, so installing Python, I guess first, just personally, if you had a new computer, well, what operating system do you like to work on?

Uh subscription.

Just you personally.

Ee Durbin

My desktop is Mac OS.

Okay.

Will Vincent

How do you what do you what do you use?

Pip, pipem, like you know, if you have so if you have a if you bought a brand new Mac and you're just gonna install it from scratch, how would you do that?

Because I was just updating my books on Django and being like, okay, here we go.

Like, you know, there's four or five different ways to install Python.

I'm curious what you what you personally do and then what you recommend if you get asked about.

Ee Durbin

It's gonna sound like propaganda, but it's not.

I have been using the installers from python.org as long as I can remember.

Um, it is

Will Vincent

well that's I think that's now the you know, certainly on Mac, Homebrew has its issues.

Carlton and I were texting about this earlier.

So that you know, for someone who knows what they're doing, the installers on both Windows and Mac would be the way to go.

Carlton Gibson

It's not even know what you're doing.

It's download it, it's double-click the DMG file, it's run the installer.

It's like a it's a fully packaged installer for you.

Same on Python.

Will Vincent

Yes, but Carlton, everyone by the time they come to you has clicked around and half installed five different ways.

Yeah, okay.

And their path is messed up.

And they're like, how do I fix

my path?

Ee Durbin

Yeah, so I mean, my my my setup is this.

I, you know, I I still work on projects that use various Python language or Python versions.

I still have to worry about that.

And so for a lot of environments, what I'm doing is a brand new computer gets like the latest 2.7, the latest like 3.6, 3.7, 3.8, 3.9, and soon 310, um, all installed.

Um I set up a I choose I choose uh an arbitrary Python 3 to be like my my main environment.

Um that gets a uh pip install dash dash user virtual env and talks and a few other things.

Um and then as I need the other Pythons, I create virtual environments for them um explicitly.

So I don't use like a helper.

I probably should use like

Will Vincent

a do you use py env?

Ee Durbin

No.

Oh yeah, I use uh Venv uh built into Pythons, or if I'm using a Python that doesn't have Venv built in, I use uh virtual end.

Will Vincent

Maybe I'm not understanding how do you within the virtual environments point to the different Pythons?

I guess I'm very familiar with Pyenv for pointing to somewhere else.

Oh yeah,

Ee Durbin

when when when I when when you when you initiate a virtual environment or Venv, which is sort of like a very like it's a very pared-down implementation of virtual environment, uh you can specify an interpreter.

And so the result that you get is an environment that once you source it or activate it, you're using that specific interpreter and you have a empty site directory or empty site packages.

Um so then whenever you reactivate that, no matter what Python interpreter you're coming from or shell, whenever you reactivate that virtual environment, you'll get that same interpreter version and whatever dependencies you've installed.

Will Vincent

Do you use do you um do you do much with Docker in terms of like team settings?

Yeah, we

Ee Durbin

we use a lot of uh a Docker compose and and such for uh not just PyPI but also for like some of the Python infrastructure as well.

You know, it it's it it it it just alleviates so much of the concerns of reproducible environments.

Um but the biggest pain point that I have had with Docker-based stuff is it is really not kind to contributors who don't have monster computers.

Yeah.

Um and so that's a that's an that's an open problem in my book around like how do you how do you how do you help you?

Will Vincent

Yeah, you need 16 gigs of RAM basically to run anything.

Ee Durbin

Yeah, it's it's a it's it it's it's troublesome.

Uh and so in in the past when we've done sprints on PyPI like PyCon or just when I've been trying to like collaborate with folks elsewhere, you know, there are people who are very excited and motivated to contribute, um, but are almost literally uh literally unable because their computer can't run Docker or because it doesn't have enough you know resources.

So I don't know the answer though.

If anybody does, please let me know.

Carlton Gibson

I think that's a big issue is that there are you know just so many millions of people out there that have got a computer that's two, three, four, five years old that's got some version of Python installed on it, and you know they don't necessarily know what, and they don't necessarily have the technical chops to download the latest one and update, and you still want to be able to say, look, you can get started, you can work, you can do uh and you know, and they'll they'll learn the harder stuff as they get on.

But if the barrier to entry is you've got to have the latest shiny and it's gotta be maxed out to the top, that that's not what it's about.

Yeah.

Will Vincent

Yeah, I wonder, I mean, there is so I ran this site installpython3.com um to try to sort of help.

Oh go, yeah, go look at it.

It it does, it's not aesthetically amazing, but I'm about to update it again for this very problem because there's so many questions.

And um I think the Chromebook section is still on there.

So I was gonna say, so Chromebooks, um, I looked at this this fall in detail.

You can they're adding the ability to basically run Linux on them, and you can you can install Python and you can kind of get there, but I put some time into it and I could set up a dev workflow, but it was pretty hacky.

But I think that's changing with like Visual Studio Code and some of these things that will run in the cloud.

So, in terms of access, um it's exciting to me that I I think they're getting there where with Chromebook you can do it.

I mean, I have a guide up there that does work, but if you go beyond installing Python, like you know, doing a Django project, uh it it was hard for me to recommend it to someone else.

I could do it, but it was pretty painful.

Um but anyways, I'm updating that site because on that site now I wanna, you know, as I said, do that update where I believe, yeah, you if you're a beginner with Windows, use the, you know, use the Microsoft App Store, otherwise direct.

Uh I'm gonna update the homebrew section.

But I would love to have some sort of section of, you know, there's probably only a dozen different ways to screw it up, but it's just it's the path variables.

It's people just they don't know where Python's located, they don't, you know, they don't understand the command line, and striking that balance of helping them without completely overwhelming them where they, you know, can't get a foot

in the door.

Ee Durbin

Yeah, and the the the the Microsoft App Store, uh those those installers are the same as download, or not the same as, but they're packaged by the same people who package the python.org installers.

So I'm glad to see that.

Will Vincent

Maybe they're getting there's only was it it's just the temp drive.

There's there's just one or two things that are they don't have a full read uh write access to, I believe.

I'm not super sure

Will Vincent

about that.

So I wonder if they're gonna solve that.

Ee Durbin

But I am but I was excited on installpython3.com because uh you recommend Dead Snakes, and I don't know if you listen to Anthony, but I just want to give you a huge shout out.

It's like the most appreciated uh consistent effort in packaging Python for at least the Ubuntu Debian flavors of of Linux, and I I generally just reach for that.

I used to be a little bit more like the red hat side of things, and now I'm just

Will Vincent

yeah, I do recommend dead snakes.

This is yeah, this is something again I try not to look at all the time, but every six months I'm like, okay, what's let me put my hat on.

Ee Durbin

Huge shout out to Anthony.

So yeah.

Will Vincent

Well, because I think this is the problem, right?

Is that I mean, I was just looking at like Real Python has probably outside of the Python.org the most popular guide, and and that does quite a good job.

But the issue is I want to install Python.

It's like, well, there's five different ways, and then you know, scroll down.

It's like a it's almost like a recipes app.

We have to scroll down all the way, you know, by the time versus you know, install Python 3 is just like, okay, if you're Googling around for this, you don't know what you're doing, you know, you can sort of trust me, this will get it going, and then you can dive into these debates later on, trying to take a non-engineer approach to the issue, basically.

Anyways, yeah.

Will Vincent

That's always something I like to ask people.

I I thought you'd be on like Linux or something.

No, I

Ee Durbin

so my biggest thing uh was I think the first time I got a Mac laptop for uh for work, I was suddenly like I felt relieved of a lot of distraction around there there's a certain amount of like hubris in younger software developers, right?

Where it's like, oh, this is software, I can change it.

So if you're working on Linux and you don't like something, you know that you can change it.

Um and I fell into

Will Vincent

that trap.

Ee Durbin

I fell into that trap so many times.

And so eventually, when I finally got like a Mac computer for work, I was like, well, this is nice.

Like I just have to accept that this is the way this thing is.

Um I'm also a big fan of defaults, and so you know, I like my Vim.rc has one line in it, it's like syntax color, and like my bash profile has like almost nothing in it.

And like, you know, I just yeah, it's it's so it's like it's it's it's it's it's okay.

It's not perfect, and I and and people get frustrated when they see that I don't even have like tab expansion open for Vim or something, right?

I'm like, well, I just pressed the spacebar four times and like it's it's okay.

And so yeah, the guardrails is a good way to put it, but yeah, just not just accepting like, well, I can't change the way Apple decided to to make this decision.

So forward.

Will Vincent

Yeah, well, literally this morning or car this afternoon for Carlton, I was texting him because I'm um I go for for my books, I've got these projects and I go go through everything on Mac and on Windows.

And my Windows machine is it's old and bad anyway, so typing on it, I just feel kind of angry.

Um, and so I have I do have a little bit of a bias against Windows.

And I've been told by many people that it's gotten better, and I think maybe if I have a better machine, I'll you know, I won't just like ratchet up my stress every time I have to log into it.

Because most people are on, I mean, you know, the the Python survey, more people are on Windows than Mac, obviously.

Same with Django.

Carlton Gibson

I'm having fun with um Windows um for exactly the same reasons that he was saying he likes Mac.

Will Vincent

Is that you need to change what you do for a fun now?

No, no, no.

Carlton Gibson

But like uh when I pick up a Windows machine, I do I really don't know what I'm doing.

So I can't spend time poodling around in the corners because I'm just like, well, you know, I I don't know what happens if I go down there and it's all in a weird that you've got to learn this whole other shell and this whole other language, and ah I'll just do what I'm gonna do and I get more done.

Ee Durbin

It's and the best part is the best part is that somebody has already figured that out.

There's somebody for whom it is it is rewarding to figure out how to accomplish those things.

And so you find them, you use their reference, and then you thank them, and then you just go on with your time.

Yeah.

Will Vincent

Well, that's farmers and chefs.

So the analogy I like to make.

You know, some people love do one crop takes years and they do a really good job.

And I'm definitely a chef.

I just you know get a recipe and maybe I tweak it, but I go to want I want to go to the store and just grab stuff, and the creativity is in the combination, not in first principles.

For sure.

It's just what type of creativity do you want to do?

Right?

Will Vincent

I mean, like, you know, where'd the grain come from?

I don't know, but I can make pretty good bread.

So I guess the last thing, I know we're coming up on time, but so Windows machines, command line prompt, like Carlton, what does one use, right?

There's PowerShell, there's like five different prompts.

Carlton Gibson

If you if you're on Windows, you use the new Windows terminal app and you use PowerShell and you learn PowerShell.

Will Vincent

Because they have a new cross-platform.

I guess PowerShell is now a cross-platform.

Carlton Gibson

I saw it.

I haven't got around to installing that on Mac, but you can, you know, you can install PowerShell on Mac now and you know.

I might try it this way.

Carlton Gibson

And they've got dot the whole .NET Core thing is all you know cross-platform now.

It's available everywhere.

Will Vincent

So if you do um if you check your Python version on a Windows machine, it will prompt you to check out the website for uh uh you know on PowerShell, it'll prompt you to check out yeah, I was seeing that this morning.

Anyways, oh last thoughts.

Um Anaconda.

So uh, what are your thoughts on that?

I mean, I've I'll tell you, I have it's fantastic, it's bundled together.

I recommend people not use that, um, but a lot of teachers say just use that because it's it is a little bit simpler if you're starting.

Ee Durbin

Yeah, so Anaconda is ultimately solving a larger problem than than than Pip does, right?

Um Anaconda is solving not just how to install Python packages, but also how to install all of the things necessary to make that Python package work.

And so it is it is a larger problem space and it, you know, and it's represented in the amount of you know labor and investment that has gone into creating Anaconda.

So, you know, I I personally uh have not used it much, um, but you know, it it it it does solve so many of the issues that you run into with you know uh software library requirements and dependencies that are not Python based.

Um at the end of the day, pip stands for pip installs python packages.

Um and that is really what what its goal is.

And so until such a time where you know the broader Python packaging ecosystem has a solution for declaring, for explicitly declaring um how to install dependencies that aren't Python, you know, the the solution really is uh something akin to Anaconda.

But the when you look at the Condoforge project, which is also volunteer driven or foundation driven or community driven, um condaforge has an immense effort to produce the results that it does.

Um and they speak for themselves.

It is truly like the easiest way to install some of the you know more complex projects out there.

Will Vincent

So yeah, well, and there's the mini conda flavor too, which um is uh what I found was the best on a Chromebook.

So it's as you say, it's a whole ecosystem.

We had the the PyCharm folks on a little bit recently, again, thinking of you know, beyond just Python.

So if you use Django with with PyCharm, it comes with a whole lot of other goodies.

Yeah, and there's like that that make a lot of sense, and it's all yeah, it's a lot of investment to make that happen.

Ee Durbin

And then another shout-out there would be uh along the lines like Pi Wheels.

So Ben N at all uh produces this project called Pi Wheels.

Um, and this is you know an index of wheels that are pre-built for installation on the Raspberry Pi.

Um yeah, yeah, yeah.

Ee Durbin

And so that's a really interesting solution to a very specific uh target um for installing you know complex Python packages.

And wheel itself produces the ability to target that specifically.

Um and so I think that the the components are there and the ecosystem, you know, there are so many people involved in the wide open Python packaging ecosystem that build a consensus and building uh a direct way forward to start defining and maintaining these specifiers, um, you know, and starting to roll that out and building standards that everyone can uh can can can can comply to.

I think that provides a really good opportunity in the future for wheels to step in uh to cover some of those bases.

I don't think there will be a point where the I guess maybe this is pessimism, but it does it doesn't feel like there will ever be a point where the uh volunteer and community-driven Python packaging standards uh meet every single niche use case um and match every single expectation that that that you know certain people would have.

And so but I think that there's uh there there's the building blocks in place for us to see a a solution that meets 80% of those needs or or much more honestly, you know, with time.

So I I I'm a big fan of wheels myself.

Carlton Gibson

So this is really interesting topic because you know, I'm a Python user, you know, and I'm work on Django and you know, uh but the Python packaging landscape just confuses the heck out of me.

And you know, I'm an I'm a quote unquote expert.

Ee Durbin

I am an expert in one part of the Python packaging ecosystem.

Carlton Gibson

But right, yeah.

You you've got you've got that, you know, but I'm not an expert on packaging, but I'm you know, I'm supposed and I'm just like, I don't I you know what what's going on with you know setup.config versus py tomal or py project.toml.

I don't know, I don't know.

I see all these peps come out and it's like and I just have I kind of nice to hear you say that you think it will come together and meet the you know 80% plus

use case.

Ee Durbin

I think we're already at 80% plus, I mean, for for for a lot of stuff.

But I just think there's a there's a there's there's what's necessary in place to see uh a better story with time.

And a lot of that will just come down to facilitating conversations and building consensus, I think.

Will Vincent

So as a last question, if you in your role at the PSF, if you had you know the power to do whatever you wanted, what's on your wish list for you know fixing ongoing stuff or new projects that would be fun to tackle?

Ee Durbin

Ooh.

Um I have to admit that you've caught me in one of the busiest times of the year.

Um and so my

Will Vincent

so sitting on a beach doing nothing or say sitting wherever doing nothing would be

Ee Durbin

well, um like you know, right right now we've got PyCon coming up uh in in in just about five weeks.

And so, you know, that sort of turns into an all hands-on deck amongst the PS PSF staff as well as all the PyCon volunteers.

And so, you know, that's very much like what's what's what's top of stack right now.

Um but I I think as far as what the PSF does, uh if I could wave a magic wand and and have and and have something fixed, I think it would be along the lines of you know the way that we communicate and engage with the community and let them know not only what we're up to, um, but also what we can, you know, how we can be there for them.

So yeah, but again, the most recent hire actually is is sort of on that outreach, not outreach necessary, but on that fundraising and dedicated fundraising.

And that inherently requires some of that work.

And so I'm really excited to see where where that goes because I think to a lot of folks the PSF is a little bit, you know, uh they just sort of assume it has something to do with Python that's really important, and I agree.

Um, but not necessarily in the way that most people would uh infer.

Will Vincent

Well, I think Django has the same issues.

I mean, in terms of most people have don't know about the DSF, I'd imagine.

They don't need to.

Um, but how can we communicate, you know, the good things, things where we need help on, you know, growth areas.

I mean, obviously when a new version comes out, we can announce that, but um yeah, it's hard it's hard to corral volunteers to do that kind of thing and figure out what's the balance between pestering people and um I don't know.

I think we could do more, but it's it's hard to say.

I mean, we're very, very um careful with how we use Twitter, very careful with blog posts and anything official.

So much so that I mean this podcast is Carlton and me just on our own.

Um, there's a Django news newsletter I do with Jeff Triplett, but that's deliberately separate from Django because like who at the DSF in a volunteer capacity would do a newsletter?

Like it's a bit of work.

So there's all these things that I think contribute on the edges and are better off there than being consumed within Django itself.

Um but yeah, at the same time, you know, we had just added, I guess the last thing I'm I'm proud of, and I keep constantly plugging.

There's a a forum um dot Django Project.com.

Is that the URL, Carlton?

The Django forum.

Yeah.

You know, that has a lot of really smart um people on it as a you know way for people to ask questions and it gets traffic, but it doesn't have anywhere near what it could.

I mean, if people knew that if they asked there as opposed to Stack Overflow, they would have, you know, the right people answering it, um, but it's just not used um as much as it could, could or should be.

Less elegant way of saying I agree, communication is tough for for for Django as well.

Ee Durbin

Absolutely.

No, but I think that what I think the one of the first times I became deeply aware of the DSF was when the Django uh fellows program was announced.

And that that that that has continued to be you know a really interesting and apparently fruitful uh way of you know providing value to the community.

So definitely tip

Will Vincent

Well, there's a there's a new C Python fell fellow or something like that, right?

Coming?

Ee Durbin

So the job posting for that just went out yesterday.

So uh the Python Software Foundation has get has gotten the opportunity through funding uh to fund uh somebody to work on C Python.

And it's the first time PSF will have gotten that opportunity.

So it's it's really exciting.

And you know, again, I think that it offers the opportunity, like I said, for people to recognize like, oh, this is like a tangible, a much more tangible thing for software-oriented minds, anyway, uh uh to understand, oh, they're doing something.

And so yeah, I think that the Django Fellow program is you know very similar in that, you know, I I became aware of the DSF even because of it.

So hopefully that that hopefully that'll help us with our messaging as well.

Will Vincent

Well, we've been lucky.

We're three for three, I would say, with fellows.

So I know it's coming.

We'll have a we'll have a fellow that requires a little bit of hand holding from the board, but not yet.

In any event, um, thank you for making the time.

I know you're you got a lot that you do anyways, and then all the planning.

We didn't even get to talk about you were a US chair for PyCon um at least 2019, I think a couple years before that, right?

Ee Durbin

2018, 2019, and it was uh honestly one of the biggest honors of my life.

Will Vincent

Yeah, I remember seeing seeing you running around a lot during that, as as all the staff are at these events.

Um so thank you.

Will Vincent

Appreciate you taking the time.

Absolutely.

I really appreciate y'all.

Ee Durbin

And this was uh so so calming and relaxing, and you you're you're very pleasant to talk to.

So honestly.

Will Vincent

Oh, it's car it's Carlton.

Everyone always tells me, they're like, you know, well, it's okay, but who's that Carlton person?

His voice, he sounds smart.

Carlton Gibson

Like, I should move to America.

I should move to America.

Will Vincent

Spain, they don't dig the British.

No, no, no,

Carlton Gibson

no, no, no.

It doesn't come across.

Will Vincent

Doesn't inflect your Spanish with uh or your Catalan with extra gravitas?

Carlton Gibson

No, no, it only goes across in uh, you know the other side of the pond.

Will Vincent

Well, E, thank you again.

DjangoChat.com, chat Django on Twitter, and we'll see everyone next time.

Bye bye.

Bye bye.