Transcript: Python Infrastructure - Ee Durbin

Hi, welcome to another episode of Django Chat, a fortnightly podcast on the Django Web Framework.

I'm Carlton Gibson, joined as ever by Will Vincent.

Hello, Will.

Hi, Carlton.

Hello, Will.

He's here.

And this week we've got special guest E. Durbin.

Hello, E.

Oh, it's very good to be here.

Good to have you.

So, E, I'm almost lost to words to how to introduce you because you're kind of like

one of these figures in the in the python community that i've seen and been like you

know major major cornerstone of everything that goes on so that's i'm almost blushing

infrastructure at python right that's the quick take so that means pypi python.org we'll get into

all that that's a lot of what you do pretty much well not you could you tell us how single-handedly

that is but my sense is you drive a lot of that and that's that's truly internet scale we often

joke about django and sites trying to do things internet scale but you know running pi pi for

example that is truly internet scale yeah well i i am it is it is a portion of my full-time job

and that is supporting you know a pretty large swath of volunteers that that are also take part

But yeah, there are three people who are really, really, really actively involved in PyPI itself.

So it does end up backstopping on me, you know, occasionally.

Well, very modest of you.

Yeah, Carlton, sort of like you with Django and releases.

No, that's Marius and releases.

He's the backstop.

Yeah, we're recording this the day Django 3.2 came out.

So that's the context.

I saw, by the way.

Congratulations.

Yeah, thanks.

Yeah, it's Hacker News, you know, they had their annual, oh, Django exists and it's cool.

I foolishly glanced at the comments on that thread and it was the first comment, a couple of comments, and then you get into, oh, you know, I like Flask.

And then it's like, no, you mustn't use Flask, you must use this.

It starts with micro frameworks and then you get into JavaScript is better and then you get into Rust.

And it's like, why did I look at the comments?

I'm very lucky to have friends who look at that website for me

and help me know what I need to actually go and read.

So I try to stay away.

Oh, ditto.

I don't have an account anymore.

I only glance once a week now at this point.

It is, it's sort of, I mean, that goes for social media for me in general too.

I've pulled away because I take a glance, but, and that feels okay.

But anything more than a couple minutes and it's not good.

Yeah, once in a while there's something posted there

that actually gets any amount of praise,

and most recently it was actually related to PyPI,

and it was when we rolled out the implementation of their token scanning.

So basically if you accidentally upload one of your API tokens to GitHub,

PyPI will now revoke it almost immediately.

And the people on Hacker News seemed to like that,

So it was oddly satisfying to see PyPI and not something relating to all manner of angry thoughts.

I've got this terrible thing come across now because when I was uploading Django 3.2 today and, you know, Twine upload and it goes up and it's like legacy dot something.

I'm like, I've got to update a setting somewhere.

Now I've got you in front of me.

I'm going to be like, can you open up my config and help me sort it out?

I'm hoping that was probably a twine or set of tools,

whatever you're using to upload.

Yeah.

But it was using the legacy endpoint,

and I must go into the docs and find the, you know,

find what URL string do I need to change to get it to use the latest one?

Yeah.

Well, it's actually the same implementation.

So the reason that warning is there is so that eventually

when we do change the implementation,

um, we can use a different URL. Um, so at the very least you're not missing out on any features.

Um, you're just talking to the wrong URL. Yeah, well, that's fine. I think I, I, my,

my feeling at the time was, or, or a, I must address that. But B, if it was serious,

it would be in a different color. If it was serious, it would just give you an error

and say, it's too late. Uh, you've waited too long. Yeah, I'll fix it then.

So a lot of podcasts don't go deep on technical stuff, but since the three of us who we are,

I really want to do that today, but maybe can we quickly get your backstory? So how does one get to

this position with the Python organization? You were telling us you're based in Cleveland. I

believe you went to school there. Are you from there as well originally?

I grew up in Southwest Ohio and I came to Cleveland for school. And then I briefly

moved to San Diego after school because it was one of the only jobs I could find that would

helped me pay for those dastardly student loans um but i went to school for physics and math and

graduated into a recession um that we're all pretty familiar with um and uh the junkyard job

that i had for the first like six months after i graduated wasn't paying for things and i took a

job with uh an appraisal management company and i was just supposed to do like magical spreadsheet

things for like their business reporting um because you know physics and math yeah um i

wasn't very good at it and uh pretty quickly ended up just just through you know hobby type

interactions with computers over the years and just being decent with configuring them and such

i ended up sort of assisted men for you know sort of a standard cubicle farm type thing

and that company had like an in-house programming startup that was doing a pretty neat piece of

software and so the lead for that looked at me and said you went to school of physics and math

I said yes and so Kanan said well you can learn PHP so we'll just go ahead and have you start

programming with us since you're kind of done with automating all the workstations and stuff

and my the first time i ever wrote python was at that job and it was because i searched for

how to programmatically access stored procedures from a mysql database and lo and behold i ended

up on pypi looking at the mysql library and i was like this is the first thing i found that

can connect to mysql i might as well use it and um that's when i wrote python for the first time

So I eventually desperately wanted to come back to Cleveland.

I got a job here doing sort of Linux sysadmin type things, you know, and continuing to write Python to automate stuff.

And through a local community and like the local Python user group, I was introduced to an opportunity to volunteer, I'm sorry, to do part time work as a sysadmin for the PSF.

I took that part-time job, and that's how I got introduced to, like, you know, PyPI and Python.org and such.

Pretty much immediately quit billing and, like, submitted almost no invoices and pretty quickly turned into mostly just a volunteer at the infrastructure and did that for, you know, a number of years.

And, you know, that is really, to me, how I got introduced to so many people in the community is, you know, I was volunteering on the infrastructure.

which covers, you know, all manner of technical concerns for the community, as well as community

concerns. You know, so I would interact with the PyCon staff to help get the PyCon site going and

things like that. And then just, just kept at it. And I mean, there's, there's a ton of wonderful

people that, you know, all have a pretty common direction and goal. And they tend to be kind,

and the community shows a lot of what's, in my opinion, the best of the software industry,

or at least aspires to it. And so I kept on with that. And then years later, there became an

opportunity. And I was offered a job at the PSF to take on the infrastructure role. And I've been

there. I've been here, I guess, for it's either two or three years, and I should probably know.

it would be three years, three years in June. Wow. We had Eva on last week to talk about

her own progression from part-time to full-time and, and sort of that side of things. It,

it's sort of wild to think that the PSF was ever small because in, you know, Django land,

the Django software foundation, we look at Python and Python software foundation is this Godzilla

of a thing, but that's really pretty recent that outgrew the volunteer realm. And yeah, I mean,

And I personally remember when the PSF really was just sort of EVA as far as full-time roles go.

And so it has been interesting myself to watch it grow.

And then, you know, we just had a new person start recently.

And so, you know, my eyes light up because I'm learning so much about, you know, the community and nonprofit operations side of things, if you will.

So, you know, I am community oriented in a lot of ways, but not necessarily in the way that the PSF is.

And so it's been it's been a really amazing opportunity to stretch my legs a little bit outside of just sort of sitting at a keyboard and pounding my head against it occasionally.

And sometimes it's, you know, you actually get to talk to people or, you know, interact with the community in a way that is not just via software.

it's been very rewarding and you have these office hours or you've had them because i think we first

spoke two years ago or something like that when i was setting up a site and jeff triplett recommend

i get in touch with you around python.org which is a django site and that was so i guess my question

is do you still do that is that that's something you did a lot of because it was very generous of

you to just have open office hours the office hours were um initiated during my time as the

PyCon chair. And so this was before I was a PSF staff member, you know, and I was also a volunteer

chairing PyCon. And a big aspect of that is, you know, I recognize the, you know, the position

that PyCon has in the community. But I also personally very much recognize the immense value

in regional organizing. And so the office hours were a really good opportunity for me to provide

you know, that, that low, low intensity space to meet a lot of folks from, you know, different

regions and different parts of the community that, that sometimes can't even make it to PyCon in

person. Um, I kept doing them for a while. Um, and I think I took it down about a year ago,

um, as the stress of the current world circumstances, uh, just became a little bit

much for me so it's actually i appreciate the reminder because it's something i

probably in a much better place to put put back into into service it's something i've been thinking

of actually because i saw simon wilson said he does he's doing office hours for his data set

project and he said i really recommend this i'm thinking well maybe i could squeeze one how did

you run it did you did you um just like have a a video call or did people book a meeting or did

i used a service that allowed um for integration from my calendar to a set of slots that i'd

predetermined to be like yeah i think it was was it calendly or that's one of those yeah it's one

of those yeah i just tend to not plug brand names but yeah it was calendly um yeah and then i had

that that's the idea of carlton yeah you just say this is when and then someone and i i assume

actually i don't know on your end can you sort of say no like what's the last minute someone can do

it right like there must be some sort of yeah you can tell it like you can you can only schedule 24

hours or seven days or whatever in advance and then my favorite part is that you can say

don't allow for somebody to book like within 15 minutes of a previous thing ending or before

another thing so it's really nice because you just open up the the little windows and

uh windows of time and then it just sort of takes care of the rest and you'll just get an email when

somebody books it and it shows up in your calendar and you know it's cool i i i do recommend uh you

know some automation around it because otherwise you're you'd be doing some you'd be doing a lot

of work to offer that up and it would become probably more stressful than it's worth it's

so funny that it it works i think really well in a non-profit or in a volunteer setting but

on the business side i've i've had it used in the business side and there it becomes more of a it's

totally a power move it's like who's gonna set who you know someone will ask something ask for

a meeting and they're like here's my dates and it's it so it's so nice actually when it's just

like okay like you want something for me like here's my calendar it's so much simpler than

in the nba world which i spent some time in it it sort of weirdly becomes this pissing match of

sorts so it's nice to hear that it doesn't have to be like that i just have some scar tissue around

as soon as someone would send me one i was like what there were a few times where people would

schedule to try to sell me things um or convince me to do weird weird stuff but like you just you

just hang up on the call and you go you go on with your day one click yeah that was the most fun

right well so can you talk about then the so what is the scope of infrastructure so i've

I guess to me, I know PyPI, Python.org, but there's more than that.

How do you define it in terms of what takes up your time?

Sure. So the PSF operates infrastructure both for the community.

And so that would be a lot of the public-facing stuff like Python.org and PyPI and the wiki and the PyCon site and such.

We also operate some infrastructure for our own operations.

you know, so internal sites for membership data and, and, and things like that. Um, and then we

also in the last few years have been either providing, um, infrastructure or collaborating

or supporting infrastructure for our fiscal sponsor ease. So the PSF, uh, recently took on

the ability for organizations who aren't quite big enough to be at their own nonprofit, um, but need

that structure around

you know

the

the tax incentives and such, um, to apply to be fiscal sponsor ease. Um, and so we have a couple

of those, uh, like the most recent one is the Python package authority, uh, is the most recent

fiscal sponsor. Uh, and that allows that will allow them to, you know, do fundraising, uh,

in a, in a, in a nonprofit sort of way. And we've already been supporting the pipe PA

infrastructure stuff things like packaging about python.org and uh such so it's realistically um

you know almost everything online on the python.org domain um as well as uh pypi and and a few other

things so oh and then like really mundane things like uh who holds the registration for a given

domain. So the PSF, you know, we make sure that these domains remain registered and that there

are funds to renew them for a number of, you know, a number of smaller projects and things.

That all sounds very familiar.

Yeah. You know, I guess the less than glamorous way to describe it is, you know, the PSF

infrastructure is realistically here to make sure that the really boring mundane things do get done.

Um, and, you know, occasionally, and it's exciting always, of course, uh, there are

opportunities to, to build out new things or improve or, you know, rebuild, uh, existing

stuff.

Uh, but there's a lot of running around to do to make sure that TLS certificates remain,

uh, valid and, uh, such.

And with volunteers, especially, right.

I mean, we have that with, you know, Django cons, not to mention other things.

there's you know quite a bit of that at the board level yeah carl level but the the ops team you

know it's so there's maris and i who are you know we're contracted but the rest of it's all

volunteers and you know they're busy rebuilding servers you know on the weekend and all the rest

of it and it's like you know amazing that it works um you know it's sort of a bunch of people

who you know swoop in when they need to and then hopefully otherwise can kind of i mean they all

have you know they don't get paid for it so right yeah and so there's a lot of that too so

facilitating uh various working groups you know a really active one is the documentation working

group so docs.python.org you know there's a lot going on behind the scenes there um and you know

realistically you know it's my responsibility if infrastructure concerns of that have a problem

So whether it's the places where the code runs and such, but, you know, it is volunteers that push basically all the forward progress that's visible is driven by volunteers most of the time.

And then the infrastructure is ideally the thing that no one else is worried about unless they want to be.

Well, there's also there's the technical infrastructure.

And then, as you were saying, just the infrastructure of a nonprofit or a community thing.

I mean, we spoke obviously a lot with Eva about that, but so much of that is people

don't think about in terms of, I mean, she mentioned, you know, going out for grants

and Python has built, the PSF is building up the capability to support those properly.

I mean, those are things we can't do right now.

And even the fundraising, Carlton spent quite a bit of time updating our, because Stripe

changed their end of things, you know, donations to Django.

It's been interesting to see GitHub sponsors, you know, GitHub is, I'm sure by the time this

launches, they're going to have corporate sponsors as well. So they're making a big push there. And

on the one hand, it's great, because that's no easy thing to manage all that. But if it's

Microsoft managing every nonprofit in the tech space, there's, I suppose, some concerns as well.

But the demands are real and largely behind the scenes around both sides of the tech side. And

then just running a non-profit with software yeah and then there's keeping track of all the various

ways that you know contributions come in uh and so that's where you know that the accounting team

at the psf has a lot of work to do because you know get up sponsors sounds so good on paper

from a i want to give money perspective uh and it sounds so good from i want to receive money

perspective but then there's the aspect of oh wait but that's a whole nother reporting pipeline

for contributions and such so yeah the the infrastructure aspects like the the non-technical

infrastructure aspects are yeah i mean there's just a number of systems and all sorts of things

going on and there's no one one there's no there's i guess there probably is just like

quickbooks for accounting that takes care of all of that that's where it all ends up but it's

getting there right but i mean yeah it's just it's non-trivial i mean there's that's why you

you all have three accountants carlton you're gonna say i was just gonna say on the github

front that you know thinking so i'm um based in europe and i'm um in spain called my status is

autonomo like it's self-employed basically it's um you know particular type of tax setup but in

order to have github sponsors i'd need to be able to um identify the payers and whether they'd have

to have a tax number and all of these things and it's none of that's available and it's like so

literally i can't accept github sponsorship money without breaking the the you know european and

spanish tax laws and it's it's like so it's it's a nice idea but the reality is it's not compatible

with you know yeah moving money internationally is difficult that's for sure um you know we've

we've been really lucky you mentioned them earlier we've been really lucky to facilitate a number of

grants um for improvements and you know contracting uh the people who are most apt to do the work has

met you know international uh contractors and that in and of itself uh is an amazing uh web

uh of nonsense to cut through so well we i mean to you know so there's two django fellows carlton

and marius and each of them gets paid a different way in a different form manually um so i can we

can only imagine the scale python's at i hadn't i didn't think about this bit that sponsors thing

carlton that's that's so you can't what if so you you can't accept yeah i don't know what's

an equivalent those like buy me a coffee things you couldn't do one of those maybe you can if

you've got if they've got the right um collection so you could set the way you end up doing it is

to set up a stripe the payment thing and you make that you just get them to put in their actual

details and they can do it there but like these services where they try and make it easy unless

they're collecting the right um data or they act as the seller of record i think it's called like

the you know so yeah like gumroad does yeah yeah so gumroad you gumroad are the people doing the

payment and you just they pay you a royalty and so that's fine you can use do that but if they're

paying you directly you have to collect all these details and you know well i don't yeah

i mean i think that stuff is you know stripes improving what it automatically handles around

taxes and all the rest i mean it's a slow process it's also the case that with sales tax like on

books for example a lot of times or digital goods the rules only apply if you're at like a six

figure or above level i mean they they recognize that it's impossible to enforce so you know the

nights in the united states you could argue that every state tries to get their hands on a digital

transaction in some way but you know it's basically i mean i spent quite a bit of time

trying to figure this out there's whole services that will calculate online sales tax um for you

and it's impossible to do um but it's largely you know only for transactions i believe it's

generally high six seven figures before they even say you're supposed to try to do these things

because it's you know nobody can but anyways it's a real concern it's difficult right try to stay

try to stay away from it yeah yeah so so i wanted to talk about um pi pi right so i go pip install

django and it goes and fetches it and how on earth does that work because there's a not like

you know i know there's a server and it serves the files but i mean you know in terms of that

works reliably for how many people per day and you know how has that grown up and you know now

this is this is a place where i'm always happy to plug um realistically pi pi uh exists as reliably

as it does because of fastly our cdn provider um fastly is extremely generous in the the amount of

traffic that they handle for us. So this is on the petabyte scale per month now. Um, and so,

you know, PyPI's backends are by no means, um, small, uh, but relative to the amount of traffic

we do at the edge, they are, they are minuscule. So for 90, 97 plus percent of pip interactions

with PyPI, you are probably receiving a page

from the simple index from Fastly

and then receiving like in their cache

and then receiving the actual file itself,

especially for a project like Django

from the cache at the edge.

Behind the scenes, we're also really fortunate

to have amazing infrastructure support

from Amazon Web Services and Google Cloud platform.

So the files themselves are stored in Google Cloud Objects,

access logs, and not necessarily access logs, I guess.

A better way to put that is access statistics are stored in Google BigQuery.

So you can go find out all sorts of amazing stuff

about who's been downloading Django from BigQuery now.

And that's accurate because a couple of years ago,

I remember trying to look into this, and the data wasn't really available.

It's been improved dramatically from work by Donald Stuft and Dustin Ingram in Linehole is the project.

And so that takes the actual access logs from the files as well as access logs from the simple index and converts them into anonymized records in BigQuery that are as accurate as we can possibly imagine.

And that's aggregating from the edges, from the CDN.

Okay, fantastic.

Yeah, so simple index access is probably the most accurate

because you have to talk to that.

With the advent of pip caching,

the actual file downloads have been minimized somewhat.

But yeah, so you can read more about that at packaging.python.org

if you search for PyPI access or PyPI usage statistics or something.

Yeah, I'll find it and put it in the show notes.

i'm i think i've seen that article before yeah and then we have like i don't know uh 12 to 15

decently sized dc2 instances um running kubernetes uh in amazon that run a handful of services that

compose pi api so there's like the main one which is the web app that you see and interact with

And then we also have the application that handles enforcing TLS for all images that

are accessed. And then we have another service that does URL magic, I guess. I don't know how

to describe it. It makes URLs work if you try to access a URL for a package file in a way that's

sort of outdated there's probably a dictionary of some kind to match those up it's so it's a

conveyor does it also serves those old like docs.pythonhosted.org um and then then it turns

the way that pypi files used to be stored were like slash capital or slash first letter

slash project name slash, and then a bunch of files. And so you used to be able to reliably

say like, I want to go get this file. I don't even know its name, but I know that it's the

project at this version. And so you just guess, um, because of the scale of PyPI that, that,

that had to change because like S3 buckets and Google cloud buckets and stuff, don't deal with

these like these these sorts of or didn't used to deal with these sorts of file file hierarchies

so now it's like slash packages slash like a bunch of hash gibberish and then the actual package

itself um and so that you know you kind of want people to be able to access the file the way they

used to so conveyor exists for that purpose as well um yeah and then we we use pretty we we try

to maintain. I think a big reason why PyPI has done as well as it has growing is right off the

bat, vastly, that takes a lot of problems off of our shoulders, as far as just the sheer volume.

And then otherwise, we've made really boring choices around technology for how to get to

where we are. And so we're still just using, you know, a moderate, moderately powerful Postgres

instance and some Redis and, you know, uh, unfortunately not Django, uh, but a very Django

inspired implementation of pyramid. Um, uh, Donald has often said that he accidentally built like,

you know, a bunch of what he knew from Django into warehouse to make pyramid work more like Django.

Um, so yeah, it, it, it, and then just G unicorn and engine X and it just sort of all works. Um,

we've done a lot of learning on how to push uh what's there uh to to the scale as well and you

know things break and they'll always continue to break but simple choices and trying to keep

trying to keep our footprint small can you talk about the growth i mean i maybe it's in that

where you referenced i've seen the charts of you know just downloads from pi pi in the last

a couple of years and it's almost exponential.

And how much of that is CI?

Is it, is it people?

Yeah, that's Carlton's thing, yeah.

No, but is Python that much more popular?

Cause it is much more popular.

Or is it like, you know,

that we're all running 58 get home action jobs every day?

tell me yeah i'm not i'm not i guess i've never i've never seen an analysis and i've never like

been able to perform an analysis to pinpoint one thing um and it also depends on what we what we

talk about when we talk about growth so if we just look at requests to the service or if we just look

at bandwidth or if we just look at number of projects and stuff you know there's sort of

different axes right um when it comes to bandwidth our biggest bandwidth growth has been in data

science and machine learning um projects and the binary wheels that support you know computing on

gpus right like that's contributed massively to our bandwidth um when we look at requests i would

assume that like requests to the service a lot of that is driven by ci you know of course um some

of the bandwidth probably is because caching and ci is a unsolved problem it would seem um

yeah and then you know what one of my favorite one of my favorite metrics to look at is new

project registration um and so you know we that that that growth i think is probably the closest

you could get to the popularity of the language right so the the more people are publishing new

and novel projects um the more the i think that that that shows a healthy ecosystem um so you

know that growth has been pretty steady all things considered and accelerated significantly due to

like code generation things right you know so you know some some people like that one their one

repository might create hundreds of sub projects right but that's that's not super common

Um, yeah. And, but yeah, I think data science and machine learning have been,

you know, the most obvious growth aspect for, for both Python and PyPI in my, in my assessment.

Okay. And talking about registering new projects, one thing that was crossing my mind

in the last week or so was about namespaces and like the sort of name collisions on PyPI. Is that,

is that a big issue or is there moves in the ground to take for instance the swift ecosystem

whereas they they they do it by urls so if you've got your your your repo url it's it's namespace

per user kind of thing sure so i it's the namespace issue has a couple of implications um

as far as like when i hear that when i hear when i hear that word it's like it's ringing some bells

and turning some lights on um so one of the most recent conversations on name spacing has been

around some of the you know the published uh i don't know if you are did either of you see the

article about like dependency confusion yeah there was a thing about poisoning dependencies and yeah

packages which perhaps were malicious named very similar to existing packages so yeah or or named

precisely like an internal package that isn't actually published to the index oh yes yeah

that one yes so you know the the as it's it's interesting because you see these

wonderfully named projects pop up on the index and you're like that wasn't taken how um so you

know we're working with arbitrary like strings of characters and so the human mind will always

come up with uh things like you know to to fill out that that that that space i think um so from

from like exhausting the list of usable names on pypi i don't think namespacing is necessarily a

big concern but on these other aspects of uh you know provenance of of a project validity of a

project and safely managing installations at clients,

I think namespacing has a lot of opportunity

to help ease some of these concerns.

And it is something that we're, there's

an open issue on the GitHub tracker for it,

and it's something that we're really interested in pursuing

and are hoping to be able to do so rather soon.

So there's some really exciting announcements that do pertain to PyPI and packaging that are going to be coming through, I think, probably in the next week or so.

So I definitely recommend checking out the Python Software Foundation blog at python.blogspot.com.

Yeah, I think Eva hinted at those as well.

So, in fact, I think it'll be out by the time this airs.

So I'll put a link to the PyPI news.

So I think with time, we'll see a lot of these things develop.

And we're really excited to have the chance to pursue things of that scale.

That's a rather big change to the ecosystem.

That's a rather big change to the service.

But we're excited the opportunity to be able to pursue those more consistently.

So PyPI itself has seen a large amount of investment over the years.

Mozilla Foundation funded the launch of the rewrite of PyPI.

Open Technology Fund funded some really big security improvements

and user experience and internationalization improvements to PyPI.

The Chan Zuckerberg Initiative and Mozilla, again,

funded a bunch of work on PIP last year.

But as amazing as the outcomes are, it does stink because it's just like we get all of

this done and then there's no more money or there's no more roadmap for what's to be done

next.

And so people sort of disperse back to what they were doing.

Right.

The maintenance is less fun than the greenfield.

Sure.

So we're really excited to hopefully have improvements on that story, not just for

pypi but for python packaging more generally it's yeah i mean it's hard to create a roadmap when

it's like you know there's there's there's well there's a bit of a there's a you know a bit of

momentum here and then okay well that's finished what do we do oh yeah as you say wander off and

go back to what you're doing yeah it's not common that somebody just sits down and says i want to

go through a month's long project as a volunteer to add a feature to a service right um that's a

that's a huge commitment as a volunteer yeah yeah so you mentioned pip i wanted to ask you

so installing python i guess first just personally if you had a new compute well

what operating system do you like to work on just you personally my desktop is mac os

okay how do you what do you what do you pip pip m like you know if you had so if you have a you

bought a brand new mac and you're just going to install it from scratch how would you do that

because i was just updating my books on django and being like okay here we go like you know there's

four or five different ways to install python i'm curious what you personally do and then what

you recommend if you get asked about it's gonna sound like propaganda but it's not i have been

using the installers from python.org as long as i can remember um it is well that's i think that's

now the you know certainly on mac homebrew has its issues carlton and i were texting about this

earlier so that you know for someone who knows what they're doing the installers but it's not

even on both windows and mac would be the way to go it's not even know what you're doing it's

download it's double click the dmg file it's run the installer it's like a it's a fully packaged

installer for you same on python carlton everyone by the time they come to you has clicked around

and half installed okay yeah okay their path is messed up and they're like how do i fix my path

Yeah. So, I mean, my setup is this. I still work on projects that use various Python versions. I

still have to worry about that. And so, for a lot of environments, what I'm doing is a brand

new computer gets like the latest 2.7, the latest like 3.6, 3.7, 3.8, 3.9, and soon 3.10 all

installed um i set up a i choose i choose an arbitrary python 3 to be like my my main environment

um that gets a pip install dash dash user virtual env and tox and a few other things

um and then as i need the other pythons i create virtual environments for them

explicitly so i don't use like a helper i probably should you know do you use pyem no i use a venv

built into pythons or if i'm using a python that doesn't have been built in i use uh virtual end

maybe i'm not understanding how do you within the virtual environments point to the different

pythons i guess i'm very familiar with pyem for pointing to somewhere oh yeah when when i when

when you when you initiate a virtual environment or then which is sort of like a very like it's a

a very pared down implementation of virtual environment,

you can specify an interpreter.

And so the result that you get is an environment

that once you source it or activate it,

you're using that specific interpreter,

and you have an empty site directory or empty site

packages.

So then whenever you reactivate that,

no matter what Python interpreter you're coming from

or shell, whenever you reactivate

that virtual environment, you'll get that same interpreter

and whatever dependencies you've installed.

Do you do much with Docker in terms of team settings?

Yeah, we use a lot of Docker Compose and such

for not just PyPI,

but also for some of the Python infrastructure as well.

It just alleviates so much of the concerns

of reproducible environments.

But the biggest pain point that I have had

with docker-based stuff is it is really not kind to contributors who don't have monster computers

yeah um and so that's a that's an that's an open problem in my book around like how do you

how do you how do you help you need 16 gigs of ram basically to run anything yeah it's it's it's

troublesome and so in in the past when we've done sprints on pi pi like pi con or just when i've

been trying to like collaborate with folks elsewhere you know there are people who are

very excited and motivated to contribute but are almost literally literally unable because their

computer can't run docker or because it doesn't have enough you know resources so

i don't know the answer though if anybody does please let me know i think that's a big issue

is that there are you know just so many millions of people out there they've got a computer that's

two three four five years old that's got some version of python installed on it and you know

they don't necessarily know what and they don't necessarily have the technical chops to download

the latest one and update and you still want to be able to say look you can get started you can work

you can do and you know and they'll they'll learn the hardest stuff as they get on but if the barrier

to entry is you've got to have the latest shiny and it's got to be maxed out to the top that

that's not what it's about yeah yeah i wonder i mean there's so i run this site install python

3.com um to try to sort of help i'll go yeah go look at it it does it's not aesthetically amazing

but i'm about to update it again for this very problem because there's so many questions

and um i think the chromebook section is still on there so i was going to say so chromebooks

um i looked at this this fall in detail you can they're adding the ability to basically run linux

on them and you can you can install python and you can kind of get there but i put some time into it

and i could set up a dev workflow but it was pretty hacky but i think that's changing with

like visual studio code and some of these things that will run in the cloud so in terms of access

um it's exciting to me that i i think they're getting there where with chromebook you can do

it i mean i have a guide up there that does work but if you go beyond installing python like you

know doing a django project it was hard for me to recommend it to someone else i could do it but it

was pretty painful but anyways i'm updating that site because on that site now i want to you know

as i said do that update where i believe yeah you if you're a beginner with windows use the you know

use the Microsoft app store, otherwise direct, uh,

I'm going to update the homebrew section,

but I would love to have some sort of section of, you know,

there's probably only a dozen different ways to screw it up, but it's just,

it's the path variables. It's people just,

they don't know where Python's located. They don't, you know,

they don't understand the command line and striking that balance of helping

them without completely overwhelming them where they, you know,

can't get a foot in the door.

Yeah. And the, the, the, the Microsoft app store, uh, those,

those installers are the same as download or not the same as,

but they're packaged by the same people who package the Python.org installers.

So I'm glad to see that.

Maybe they're getting, there's only, was it, it's just the temp drive.

There's, there's just a one or two things that are,

they don't have a full read or write access to, I believe.

I'm not super sure about that.

So I wonder if they're going to solve that.

But I am, but I was excited on installpython3.com because you recommend

dead snakes and I don't know if you listen to Anthony,

But I just want to give you a huge shout out.

It's like the most appreciated, consistent effort in packaging Python for at least the

Ubuntu Debian flavors of Linux.

And I generally just reach for that.

I used to be a little bit more like the Red Hat side of things.

And now I'm just...

Yeah, I do recommend Dead Snakes.

This is, yeah, this is something, again, I try not to look at all the time, but every

six months I'm like, okay, what's...

Let me put my hat on.

Huge shout out to Anthony.

So, yeah.

Well, because I think this is the problem.

is that, I mean, I was just looking at like real Python has probably outside of the python.org,

the most popular guide, and that does quite a good job. But the issue is, I want to install

Python, it's like, well, there's five different ways. And then, you know, scroll down, it's like,

it's almost like a recipes app, we have to scroll down all the way, you know, versus, you know,

install Python three is just like, okay, if you're googling around for this, you don't know what

you're doing. You know, you can sort of trust me, this will get it going. And then you can dive into

these debates later on, trying to take a non-engineer approach to the issue, basically.

Anyways, yeah, that's always something I like to ask people. I thought you'd be on like Linux or

something. No, I, so my biggest thing, uh, was I think the first time I got a Mac laptop for,

uh, for work, I was suddenly like, I felt relieved of a lot of distractions.

around that there's a certain amount of like hubris in younger software developers right

where it's like oh this is software i can change it so if you're working on linux and you don't

like something you know that you can change it and i fell into that trap me guard yeah i fell

into that trap so many times and so eventually when i finally got like a a mac computer for

for for work i was like oh this is nice like i i just have to accept that this is the way this

thing is um i'm also a big fan of defaults and so you know i like my vim.rc has one line in it

it's like syntax color and like my bash profile has like almost nothing in it and like you know

i just yeah this it's so it's like it's it's it's it's okay it's not perfect and and people get

frustrated when they see that i don't even have like tab expansion open for them or something

right i'm like well i just press the spacebar four times and like it's so it's okay and so

yeah the guardrails is a good way to put it but yeah just not just accepting like well i can't

change the way apple decided to to make this decision so forward yeah well literally this

morning or this afternoon for Carlton, I was texting him cause I'm, um, I go for, for my

books. I've got these projects and I go, go through everything on Mac and on windows and

my windows machine is it's old and bad anyway. So typing on it, I just feel kind of angry. Um,

and so I have, I do have a little bit of a bias against windows and I've been told by many people

that it's gotten better. And I think maybe if I have a better machine, I'll, you know, I won't

just like ratchet up my stress every time i have to log into it because most people are on i mean

you know the python survey more people are on windows than mac obviously same with django i'm

having fun with um windows for exactly the same reasons that he was saying he likes mac is that

you need to change what you do for a fun man no no no but like when i pick up a windows machine i

really don't know what i'm doing so i can't spend time poodling around in the corners because i'm

just like well you know i don't know what happens if i go down there and it's all in a weird you've

got to learn this whole other shell and this whole other language and i'll just do what i'm

going to do and i get more done it's brilliant the best part is the best part is that somebody

has already figured that out there's somebody for whom it is it is rewarding to figure out how to

accomplish this thing and so you find them you use their reference and then you thank them and

then you just go on with your time yeah well that's farmers and chefs it's like the analogy

you like to make you know some people love do one crop takes years and they do a really good job

and i'm definitely a chef i just you know get a recipe and maybe i tweak it but i go to i want to

go to the store and just grab stuff and the creativity is in the combination not in first

principles the the producing a a usable first principle can take a lot of creativity

for sure it's just what type of creativity do you want to do right i mean like you know where

the grain come from i don't know but i can make pretty good bread so i guess it's the last thing

i know we're coming up on time but so windows machines the command line prompt like carlton

what does one use right there's powershell there's five different prompts if you're on windows you

use the new windows terminal app and you use powershell and you learn because they have a

new cross platform i guess powershell is now cross platform i haven't got around to installing that

on mac but you can you know you can install powershell on mac now and you know i might try

And they've got the whole .NET Core thing is all cross-platform now.

It's available everywhere.

If you check your Python version on a Windows machine,

it will prompt you to check out the website on PowerShell.

It'll prompt you to check out.

Yeah, I was seeing that this morning.

Oh, last thoughts.

Anaconda.

So, E, what are your thoughts on that?

I mean, I'll tell you, it's fantastic.

It's bundled together.

i've recommended people not use that um but a lot of teachers say just use that because it's it is

a little bit simpler if you're starting out so anaconda is ultimately solving a larger problem

than than pip does right um anaconda is solving not just how to install python packages but also

how to install all of the things necessary to make that python package work and so it is it is a

larger problem space and it, you know, and it's represented in the amount of, you know,

labor and investment that has gone into creating Anaconda. So, you know, I personally, uh, have

not used it much. Um, but you know, it, it, it, it does solve so many of the issues that you run

into with, you know, uh, software library requirements and dependencies that are not

python-based um at the end of the day pip stands for pip installs python packages um and that is

really what its goal is and so until such a time where you know the broader python packaging

ecosystem has a solution for declaring for explicitly declaring um how to install dependencies

that aren't python you know the the solution really is uh something akin to anaconda but

when you look at the conda forge project which is also volunteer driven or foundation driven

community driven conda forge has an immense effort to produce the results that it does

and they speak for themselves it is truly like the easiest way to install some of the

you know more complex projects out there so yeah well and there's the mini conda flavor too which

um is uh what i found was the best on a chromebook so it's as you say it's a whole ecosystem we had

the the pie charm folks on a little bit recently against thinking of you know beyond just python

so if you use django with with pie charm it comes with a whole lot of other goodies

yeah and there's like that that make a lot of sense and it's a lot of investment to make that

happen. And then another shout out there would be along the lines like PyWheels. So Ben Nuttall

produces this project called PyWheels. And this is, you know, an index of wheels that are pre-built

for installation on the Raspberry Pi. Oh, yeah. Yeah. And so that's a really interesting solution

to a very specific target for installing, you know, complex Python packages. And wheel itself

produces the ability to target that specifically um and so i think that the components are there

and the ecosystem you know there are so many people involved in the wide open python packaging

ecosystem that building consensus and building a direct way forward to start

defining and maintaining these specifiers, you know, and starting to roll that out and building

standards that everyone can comply to. I think that provides a really good opportunity in the

future for wheels to step in to cover some of those bases. I don't think there'll be a point

where the, I guess maybe this is pessimism, but it doesn't feel like there will ever be a point

where the volunteer and community-driven Python packaging standards

meet every single niche use case

and match every single expectation that certain people would have.

But I think that there's the building blocks in place

for us to see a solution that meets 80% of those needs

or much more, honestly, with time.

i i'm a big fan of wheels myself so this is really interesting topic because

you know i'm a python user you know and i'm work on django and you know but the python packaging

landscape just confuses the heck out of me and you know i mean i'm a quote-unquote expert and

i am an expert in one part of the python packaging yeah the system but right you you've got that you

You know, but I'm not an expert on packaging, but I'm, you know, I'm supposed to, and I'm just like, you know, what's going on with, you know, setup.config versus PyToml, PyProject.Toml.

I don't know.

I don't know.

I see all these peps come out and it's like, and I just have, I kind of, nice to hear you say that you think it will come together and meet the, you know, 80% plus use case.

I think we're already at 80% plus, I mean, for a lot of stuff.

And I just think there's what's necessary in place to see a better story with time.

And a lot of that will just come down to facilitating conversations and building consensus, I think.

So as a last question, if you in your role at the PSF, if you had, you know, the power to do whatever you wanted, what's on your wish list for, you know, fixing ongoing stuff or new projects that would be fun to tackle?

Oh, I have to admit that you've caught me in one of the busiest times of the year.

So sitting on a beach doing nothing or sitting wherever doing nothing would be like, you know, right now we've got PyCon coming up in just about five weeks.

And so, you know, that sort of turns into an all hands on deck amongst the PSPSF staff as well as all the PyCon volunteers.

And so, you know, that's very much like what's what's what's top of stack right now.

Right. But I think as far as what the PSF does, if I can wave a magic wand and and have and have something fixed, I think it would be along the lines of, you know, the way that we communicate, engage with the community and let them know not only what we're up to, but also what we can you know, how we can be there for them.

so yeah but again the most recent hire actually is is sort of on that outreach not outreach

necessary but on that yeah the fund fundraising and that inherently requires some of that work

and so i'm really excited to see where that goes because i think to a lot of folks the psf is a

little bit you know yeah they just sort of assume it has something to do with python that's really

important and i agree um but not necessarily in the right unless people would uh infer well i think

django has the same issues i mean in terms of most people have don't know about the dsf i'd imagine

they don't need to um but how can we communicate you know the good things things where we need help

on you know growth areas i mean obviously when a new version comes out we can announce that but

Um, yeah, it's hard, it's hard to corral the volunteers to do that kind of thing and figure

out what's the balance between pestering people.

And, um, I don't know, I think we could do more, but it's, it's hard to say.

I mean, we're very, very, um, careful with how we use Twitter, very careful with blog

posts and anything official so much so that, I mean, this podcast is Carlton and me just

on our own.

Um, there's a Django news newsletter I do with Jeff Triplett, but that's deliberately

separate from django because like who at the dsf in a volunteer capacity would do a newsletter like

it's a bit of work so there's all these things that i think contribute on the edges and are

better off there than being consumed within django itself um but yeah at the same time you know we

had just added i guess last thing i'm i'm proud of and i keep constantly plugging there's a forum

um dot django project.com is that the url carl yeah the django form yeah you know that has

a lot of really smart um people on it as a you know way for people to ask questions and it gets

traffic but it doesn't have anywhere near what it could i mean if people knew that if they asked

there as opposed to stack overflow they would have you know the right people answering it

but it's just not used um as much as it could could or should be less elegant way of saying

i agree communication is tough for for django as well absolutely no but i think that i think

one of the first times i became deeply aware of the dsf was when the django uh fellows program

was announced and that that that has continued to be you know really interesting and apparently

fruitful uh way of you know providing value to the community so definitely well there's a there's

a new c python fellow or something like that right just so the job posting that just went out

yesterday so uh the python software foundation is has gotten the opportunity through funding

uh to fund uh somebody to work on c python and it's the first time psf will have gotten that

opportunity so it's really exciting and you know again i think that it offers the opportunity like

i said for people to recognize like oh this is like a tangible a much more tangible thing for

software oriented minds anyway uh to to to understand oh they're doing something and so

yeah i think that the django fellow program is you know very similar in that you know i i became

aware of the dsf even because of it so hopefully that that hopefully that'll help us with our

messaging as well well we've been lucky we're three for three i would say with fellows so

i know it's coming we'll have a we'll have a fellow that requires a little bit of handholding

from the board but not yet in any event um thank you for making the time i know you're

you got a lot that you do anyways and then all the planning we didn't even get to talk about

you were a u.s chair for pycon um at least 2019 i think a couple years before that right it was

2019 and it was honestly one of the biggest honors of my life yeah i remember seeing seeing you

running around a lot during that as as all the staff are at these events um so thank you appreciate

you taking the time absolutely i really appreciate y'all and this was uh so so calming and relaxing

and you're you're very pleasant to talk to so honestly oh it's carlton everyone always tells

me they're like you know well it's okay but who's that carlton person his voice he sounds smart

i should move to america i should move to america

spain they don't dig the the british no no no no no it doesn't come doesn't inflect your spanish

with uh or your catalan with extra gravitas no no it only goes across in the you know

the other side of the pond

well e thank you again yes thank you jango chat.com chat jango on twitter and we'll see

everyone next time bye-bye bye-bye