Hello and welcome to Python Bytes, where we deliver Python news and headlines directly to your earbuds.
This is episode 390, recorded July 2nd, 2024.
I'm Michael Kennedy.
And I'm Brian Okken.
And this episode is brought to you by Scout APM.
Thank you so much to them for supporting the show.
We really appreciate them.
And if you want to attend live, get your comments in the episode, then check out pythonbytes.fm/live.
Usually Tuesday at 10 a.m. Pacific time, like we're recording right now, Brian.
Yeah.
And please visit Python Bytes, Ed FM, right on the homepage, click on newsletter, subscribe to our newsletter.
We've got lots of interesting information that we share with you.
And we're going to be doing some kind of giveaway that we have yet to determine.
And soon when we reach maybe a major milestone there.
So that'll be awesome.
Yeah.
And yeah, with that, Brian, you want to kick us off?
Sure.
What do you got for us?
Let's talk about strings for a minute.
So this one is from an article written by Veronica Olson.
And it's an article called Joining Strings in Python Aha Moment.
And I actually just really enjoyed this story because it's a it tricked me up.
And she says, I've been writing Python code for 17 years.
And then I learned something new recently from a master on conversation.
So what is the new thing?
So the idea is around joining strings.
So let's say you're like, and we do this, I do this all the time.
So you've got some input from a file.
And her example is, you've got some input from a file.
And you're going through and just using it, using the regenerator thing.
So f equals open.
And you get like this thing that you can read with.
So she's using x for x, or I usually put line.
Line for line in f.
And then also doing like some logic on it within a generator, which is kind of cool.
And once I learned this, I use it all the time.
So go through using the file as a generator to pull out lines and then only collect the lines that you care about.
And then joining it in at the end.
And so like this discussion really is when you've got a whole bunch of strings that you want to concatenate together with like new lines or something.
You just create a list of them and then join it.
But if you're using a generator, you can use a generator and pass that to join also.
So the little trick here is whether or not you should use a list comprehension.
So these two methods is you're joining a generator out of the file or you use a list comprehension within it.
And the only difference is these little brackets in there to create a generator or to create a list comprehension.
So I would think my first reaction is that it really probably doesn't matter.
But the list comprehension might be maybe I have no idea which one's slower or faster.
But the odd thing is, if it's a huge text file, Brian, if it's a huge text file, it could be a memory.
If you had a gig of text, right?
Yeah.
Then you potentially would be loading more than that in memory with the brackets, but not with the parentheses, right?
That's what I thought.
Right.
So she used a sample file like the King James version of the Bible or something.
Yeah.
Which is 800,000 words long and a ballpark of 3,000 pages.
Anyway, 200 million words.
Okay.
So did a little timing here as to whether or not you want to use a generator or a list comprehension for this.
And looking at the memory output so that the memory itself is as expected.
The generator uses less memory.
The list comprehension gradually grows and you're using more memory.
Okay.
So far, it seems like it's doing what we think it might be doing.
But the weird bit is when we go down and actually time this stuff is that the generator version without it.
And if you compare the times for the generator and the list comprehension, the generator one is slower by like 16%.
Weird.
Why?
That is weird.
Especially since the list has to like, you allocate the list, you fill the list, you reallocate the list, you copied over, like growing the list over and over and over.
Although as a list comprehension, maybe it doesn't.
I don't know.
Anyway, that's crazy.
And then adding more mystery to the mystery is that instead of join, if you use all as the thing that you're using across the entire list or generator,
it's behaving as expected, the generator is faster than the comprehension.
So what's going on?
So the discussion went online and Trey Hunter said, you should know something about join.
Join is weird in that the CPython implementation of join is a two-pass because generators can, you can't, they get exhausted and you can't use them again.
So it has some little tricks that it uses to do a two-pass over the generator.
And so therefore it is, it is the same.
The join is the same as take creating a list.
And we know that comprehensions are a little bit better than actually just creating a list.
So that little bit better is the reason why the comprehension version is faster.
Well, wait, I have no idea why.
I should have read more closely.
But there's something about this that makes it faster in when you're using joins to go ahead and use a comprehension faster.
Interesting.
And it's only in CPython.
Apparently that's not true for PyPy and, yeah, apparently you can, I don't know how they're doing it without it.
But PyPy and some others implementations of Python do not use this.
But anyway.
Interesting.
Yeah, I don't see it tested here, but the WebAssembly one would be quite interesting.
Yeah.
For PyDyde and PyScript and those kinds of things.
Definitely.
Okay.
So interesting inside baseball around, I guess, around if you want to do memory, whether you care about speed or memory efficiency.
And also.
It's weird that you got to choose though.
It is weird that you have to choose.
But also just in case you haven't seen this, this is basically the standard format for if you want to iterate through strings and combine them all into one.
Is to either throw them in a list or throw them in a comprehension or throw them in a generator and use join to combine them with a new line.
If you haven't seen that before, that's a good thing to stick in your tool belt.
Yeah.
And our Windows friends can put backslash or backslash in join for their Windows line.
Didn't he?
I'm on Windows.
I don't do that.
But okay.
I know.
It should still work.
All right.
Awesome.
Well, what do you have for us next?
Well, I'm afraid I have some hard truths for you, Brian.
Just like you've learned, it's a hard truth that generator doesn't always give you the advantages you thought.
These are hard truth, 10 hard truths to swallow that people won't tell you about your brand new software engineering job.
So this is focused at students who just recently graduated or who are getting into software development.
And that might sound like a somewhat niche crowd, but if you look at the PSF JetBrains survey, it's like the biggest group of people are like, well, you've been coding for three years or less, which is crazy.
All right.
Anyway, let's go through the 10.
This is by Mansour Durevich.
Pretty good.
A pretty good article here.
And basically says, I was talking with a bunch of students and they were all psyched about like startup culture, pizza parties and stuff.
Well, yes, but the thing you're going to do most of the time, write code.
So here are the 10.
First, college will not prepare you for the job.
So imagine your instructor spends, you go to college to learn how to swim.
Your instructor spends a lot of time teaching you about the moves, reciting the moves, asking you questions about the moves.
After five years, you get a piece of paper that proves your swimming skills.
And then you got to go in the pool and you just flail around, right?
A little bit like that.
Also, a lot of the curriculums are pretty far behind.
I remember when I was in college, I said, can I please take C++?
It's in the 90s.
They're like, no, you have to take Fortran.
It's the most important language you'll ever learn.
I'm like, okay, and then I'm like, well, let me try some CS classes.
Like, well, you got to do Lisp.
Like, really?
Can I please take something like more modern?
Like, no.
So you should have embraced the Lisp.
Yeah, I'm still not embracing the Lisp.
I like parentheses, but not that much.
Okay.
Anyway, so a lot of these folks who are professors have not been professional software developers in the engineering sense.
And so the skills that they teach you are valuable, but it's not the same as like working day to day.
This one, I think, is probably, people probably don't realize that much, is you rarely get to work on greenfield projects.
Yeah.
You get brownfield projects.
That is, you get some project that is not a three-week project, but it's something that's been around since 2003.
And you're dropped in to work on some features.
And every time you poke it, it's like a rickety house of cards.
You got to be super careful.
Right?
How does that fit with your understanding?
Yeah, definitely true.
That's one of the reasons why I encourage people to contribute to open source projects, even in large ones, because you have to get used to huge code bases.
You have to get used to getting thrown in the deep end and fix a bug, and you don't even know what the code does.
Yeah, this is essential.
Speaking of which, there's a fantastic picture for this.
So let me try to zoom that out for a second so we can see here, Brian.
So check this link out, folks.
So there's, it's like this crazy Rube Goldbergian thing.
There's a button to start the app, and it's got all these weird wires.
And there's like an elephant that's suspended, and the wire cuts the elephant loose, which drops off a rock.
And there's a security layer.
There's the core logic since 2003.
There's all these, like, third-party bits that are largely controlled by aliens.
And then there's a cloud.
And below the cloud, you can see just the base of the building.
There's two new engineers with a little button that's supposed to, like, kick this thing off or something.
It says, how hard can it be?
Come on.
Yeah.
Yeah, amazing.
So check that out.
All right.
Coming back.
Nobody gives a blankety-blank about your clean code.
You may focus on it a lot, but really, your job is to deliver features.
You're expected to write clean code, but you're not going to get, like, promotions and stuff from the business people because you write clean code.
It's because you deliver value, right?
Part of that value is clean code.
That's true, but you've got to maintain it, too.
So you should be happy with it.
Yes, you've got to live with it.
So here's my experience.
Not how do you lie, but how do you phrase things?
Like, estimates and stuff so that you're in a position so you don't have to write terrible code constantly.
Right?
So, for example, with testing or a little bit of refactoring, it's just like I would just work that into my estimates.
How long is it going to take?
It's going to take a week.
Well, it probably takes three and a half days, but then if you were to bust it out, right?
But if you're going to put in the test and do it right, it'll take a week.
So how long does it take?
It takes a week.
You know, that kind of thing.
Sometimes you'll work with incompetent people.
Oh, boy, oh, boy, oh, boy.
Yes.
And sometimes that person will be your boss.
And so.
That's even tougher.
I'll tell you a story, Brian.
You know, I used to do in-person training classes.
And there was a person who was in this class as part of a team, software development team from a medium-sized company.
One of these, like, you know, 50 million yearly revenue type companies or something.
And during that class, we were doing, like, exercises.
I'd do a presentation for an hour.
They'd spend maybe half an hour working on something.
And round and round, it goes.
So there's this part where you need a variable that has a string value.
This person has been working for at least six months, I think a lot longer, as a professional software developer in this language.
And I say, okay, you've got to create a variable there.
And you need to assign a string to it that says, you know, XYZ.
The value of the string is XYZ.
So they just write variable name equals XYZ with spaces and all sorts of stuff.
Like, no, you can't just type it into the editor.
You have to put quotes around it.
What do you mean?
You have to put quotes around this.
Like, how have you been a professional software developer at a proper company for over six months to a year and not know that sentences with spaces?
They have quotes around them to put them into code as a piece of text.
Like, could you imagine that person just like reviewing your code?
Like, oh my goodness, dude.
Yeah.
No.
That was a rough one.
Anyway, sometimes, maybe not to that extreme, but you will probably end up working with ineffective people.
Or people that don't care about your process.
Or people that don't care about your clean code or whatever, right?
All that stuff's there.
Get used to being, number five, get used to being in meetings for hours.
This is an important part of software development job.
Most meetings are not productive because you're being forced to be there by a person whose only job is to have meetings.
That's their job.
That's their work.
Right?
Which is, ugh.
However, other meetings with your team members and stuff, planning out code and whatnot is pretty good.
Yeah.
If you're the one responsible for the meeting, be okay with cutting it short.
Getting everybody together and leaving in 10 minutes is fine.
Remember that.
Yep.
Okay.
A hundred percent.
Okay.
On.
I feel like you should have done this article.
No, I'll be the heckler in the background.
It's fine.
It's good.
They will ask you for estimates a lot of times.
I told you about this one.
I mentioned this.
This is fun.
So here's a great cartoon for this one, too.
This is also a good, like, basically the joke segment.
It says, would you rather?
For better estimates, we switched from measuring story points to a different style.
We now ask, how many duck-sized horses are you willing to fight rather than implement this task?
Isn't that awesome?
Yeah.
And it sounds silly, but I kind of think of it as it's actually kind of practical.
Yeah.
It's using your, like, your desire to avoid negative stimuli more than your ability to predict something.
I love it.
That one is only a two duck-sized horse battle.
All right.
Bugs will be your arch enemy for life because they come from different places.
Could be your own code, but it could be third-party libraries.
It could be hardware failure, electricity, all sorts of things.
Uncertainty will be your toxic friend.
So it could be implementing something you never worked on.
It could be getting transferred to a new project with new technologies.
It could be a move to a new company.
It could be a bug report the day you need to finish the work.
You're going to break the deadline.
Job security, evolution technology, all these things totally resonate.
Number nine, it will be almost impossible to disconnect from your job.
So, yeah, that's rough.
But it's true because you're thinking about it, right?
Yeah.
However, a lot of these come with actually good advice on what to do to combat it or to counteract it or to deal with it.
Oh, that's good.
Because one of the best things I ever did was not – I don't have the ability to get email on my phone now, my work email.
Oh, that's nice.
Because I was checking it all the time, even when I was off work, and that was bad.
Yeah, that's bad.
Last one, number 10, you will profit more from your soft skills than your coding skills.
Not that your coding skills are important, but –
Yeah, definitely.
Soft skills are tough, and they're also required.
So, things like teamwork, learning mindset, time management, emotional intelligence and empathy, approachability, persistence, confidence, all these things amongst a whole zillion others.
Anyway, if you're new, I think this is a pretty good article.
I didn't go through all the little details, but –
Yeah.
I don't know.
What do you think, Brian?
I think the soft skills probably ought to have been at the top.
Being able to communicate well and stay positive and don't be a jerk is huge.
The ability to not be a jerk under pressure, that was a struggle for me.
Also, embracing deadlines.
People are going to ask you how long it's going to take.
You just have to learn how to do that.
Estimating is part of the job.
It sucks.
It's wrong, but you get better at it, and you're also okay about telling it.
I mean, it can be ballparks.
It's going to be – is it going to be two days, or is it going to be two months?
Pick.
People just need to know.
So, yeah.
Yeah, absolutely.
It's good.
All right.
Before we move on to the next one, let's talk about a sponsor that I'm very excited about.
Let me tell you real quick about Gout APM.
They're big supporters of Python Bytes, so we appreciate that very much.
So, if you are tired of spending hours trying to find the root cause of issues impacting your performance, then you owe it to yourself to check out Scout APM.
They're a leading Python application performance monitoring tool, APM, that helps you identify and solve performance abnormalities faster and easier.
Scout APM ties bottlenecks such as memory leaks, slow database queries, background jobs, and the dreaded N plus one queries that you can end up if you do lazy loading in your ORM.
And then you say, oh, no, why is it so slow?
Why are you doing 200 database queries for what should be one?
So, you can find out things like that.
And it links it back directly to source code so you can spend less time in the debugger and healing logs and just finding the problems and moving on.
And you'll love it because it's built for developers by developers.
It makes it easy to get set up.
Seriously, you can do it in less than four minutes.
So, that's awesome.
And the best part is the pricing is straightforward.
You only pay for the data that you use with no hidden overage fees or per seat pricing.
And I just learned this, Brian.
They also have, they provide the pro version for free to all open source projects.
So, if you're an open source maintainer and you want to have Scout APM for that project, just shoot them a message or something on their pricing page about that.
So, you can start your free trial and get instant insights today.
Visit pythonbytes.fm/scout.
The link is in your podcast player show notes as well.
And please use that link.
Don't just search for them because otherwise they don't think you came from us.
And then they'd stop supporting the show.
So, please use our link pythonbytes.fm/scout.
Check them out.
It really supports the show.
Cool.
Yes.
Thank you indeed.
Over to you, Brian.
Well, we've talked in the past about Python coming to Excel, but I haven't tried it.
So, I was kind of curious about this person that wrote up an article called My Thoughts on Python in Excel.
And this isn't just a rando person.
Apparently, this is, let's see, or maybe, I don't know.
They wrote a book on Python in Excel or reported, yeah.
Or the creator of Excel Wings, maybe?
Yeah.
I'm not sure.
Oh, yeah.
As a creator of Excel Wings, the author of the O'Reilly book, Python for Excel, I was obviously curious to try it.
So, anyway, yeah, okay.
Anyway, so somebody tried it out.
Great.
And this is from the Excel Wings blog.
So, yeah, it's probably somebody that's worthwhile looking at this and tried, actually really wanted it to work.
So, what are their takeaways?
And I'm just kind of loving this.
We'll just run through them.
We wanted it to be an alternative to VBA, but mostly got an alternative to the Excel formula language.
Okay.
So, I thought it was going to be a VBA replacement as well.
Apparently not.
The integrating the Jupyter notebook cells inside Excel grid was a mistake.
So, not sure what they did there, but apparently they didn't like that.
So, Python in Excel is not suitable for Python beginners nor for interactive data analysis.
That's kind of, that's a bummer.
So, there's that one person left.
Yeah.
Right now, there are too many restrictions.
You can't use your own packages.
You can't connect to the web APIs.
So, what are the current use cases?
Probably computationally intensive things like Monte Carlo simulations.
AI stuff via the included packages like scikit-learn, NLTK, stats model, imbalance-learn.
That, actually, that makes sense.
And so, there's a, that's a good use case, I guess, for being able to use AI scikit-learn stuff in Excel.
Nice.
Being able to use Matplotlib and Seaborn for visualizations.
That's pretty cool because these are great packages.
Time series analysis.
And, but that's really about it.
Said, not sure about data cleaning or data analysis since you're mostly certain, almost certainly need power query.
I don't know what this is.
Must be an Excel thing.
It's like a BI Microsoft Office Tableau type of thing, I believe.
Okay.
So, what's the conclusion here?
Before we dive into details, I want to clarify that this is my personal opinion and not meant to be a rant or critique, but I'm amused by it.
I've been in contact with the Excel team a few times and they're super friendly.
Okay.
So, he wants the whole thing to succeed.
So, we'll just, that's good.
So, these are just interesting takeaways.
One of the things, and then goes through a bunch of the little bits, and in more detail, the part that wasn't in the summary, which I find is interesting, is Python is not really in Excel.
It's in the cloud, which I'm surprised by.
So, as you've probably heard, but I hadn't, that the Python that you're running runs in an Azure container instance, not inside Excel.
That's just kind of weird, I think.
Did you know this?
Yeah, I did.
And it's interesting that it means that you can't configure the environment.
You can't control which Python is running.
You can't install third-party packages that are not pre-approved, like you saw that there was a list of a couple of ML ones.
If you don't like those, then you don't use it.
Well, can you do it when your laptop's disconnected, like when you're on an airplane or something?
No, I don't think so.
Okay.
You know, just like quick, to me, I was hoping for like some kind of VBA, like true automation.
Yeah.
Sort of beyond the cell, this cell, that cell.
But kind of what you do with notebooks, and then sometimes you bring in like Excel writer or something to like actually save the stuff out or something, right?
Like a little way to orchestrate bigger.
Okay.
But yeah.
So it's just different.
It's just like stuff within a cell?
Well, multiple cells, but yes.
Okay.
Well, it's not really what I was hoping for, for Python and Excel.
So anyway.
Yeah.
It's also not quite in it, right?
Say that again?
It's not quite in it.
As I said, it's in the cloud.
Yeah.
It is weird that it's got to be online only.
Yeah.
That's kind of a deal breaker for me, but maybe I shouldn't care that much.
But anyway.
Yeah.
But one of the comments around that was that it's not really a problem for a lot of people because a lot of people that are using Excel are already sharing their data through OneDrive and SharePoint.
And I don't know if that's, maybe that's a majority of corporations, but there's a lot of corporations like the one I'm in where we cannot do that because we don't want our stuff to go out anywhere.
So anyway.
Yep.
Just an interesting takeaway of, I guess, if you've been hoping and thinking, this might be a good article to peruse just to make sure that it's really your use case before you jump in.
Yeah.
Good point.
Christopher out there says, it's nice that it doesn't require Python to be installed locally, unlike Power BI.
because I wouldn't be able to have my IT department install it.
So that's an interesting bonus there.
And Avaro says, you got to fight for your right to sudo.
There you go.
Can't you, I mean, Python now, can't you install it on Windows machines?
I think you can install it in like personal mode that's just in your home directory or something.
I don't think you need like administrator privileges anymore.
Yeah, that's true with the, it's actually true.
With the Python in the Windows store and Windows 10 and 11.
Yeah.
Okay.
Henry Schreiner on the audience.
Henry says, this feels like the perfect use case for WASM.
Sad it wasn't the default.
Totally agree.
Some pyodide here would have been awesome.
Yeah.
All right.
Um.
Not as awesome.
The next thing I'm about to tell you though, Brian.
Okay.
What's, what's the next thing?
This, special live event course that I'm running.
All right.
Cool.
So this is happening in, in October and I'm doing a code in a castle event in Tuscany.
Oh, wow.
So this is a six day luxurious, core, course in a luxury, luxurious Tuscan
villa.
And every morning we're going to wake up and we're going to spend four hours working on Python.
And then the rest of the day is excursions and winery tours and other stuff around the Italian
countryside.
This looks like fun.
Sounds awesome.
Huh?
Yeah.
So the course is going to be super fun.
The course is, I called it Python zero to hero, but you don't have to actually be zero.
Just, you gotta just like, there's probably some areas of this that would be, you haven't
any, had any experience with.
So basically it takes you from, I'm maybe learning Python.
Maybe I know Python, but then talks about async and await MongoDB talks about, we cover
a FastAPI using HTMX.
We'll be back to that in just a second and building out awesome web apps and web APIs and
then performance testing this and then deploying it to Linux.
If we got time, maybe using Docker as well.
So yeah, that's, that's what the plan is and it's going to be awesome.
So if you were interested in being part of this, click the link in your player show
notes and, so show notes there.
And yeah, I think I only have a talk Python link.
So talk Python.fm slash castle is the link and everyone, when they come, they get a
room in the villa and the room has up to two beds.
So if you wanted to bring your wife or a good friend, there's actually a separate, set
of events for the people who are not in the course, but who are attending the event as like
a companion or something.
So there's like morning excursions as well.
Yeah.
I was reading up on that and it sounds really pretty like some, some good quotes from people
from last year, enjoying the plus ones, having fun in the mornings.
So.
Yeah.
Awesome.
Maybe I'll just say the morning track.
No, I'm just kidding.
So I forgot to mention this is an extra, extra, extra.
So this is number one of the extra.
Okay.
More.
Okay.
More.
So first one code in a castle, learn Python, FastAPI deployment, load testing, all that
stuff.
Hopefully you can be there.
Number two, I had this awesome use case for HTMX.
That is so incredibly clean that I just want to give people a feel for it.
So Brian, if you go to, talk Python, click on the courses, put in your course here.
Okay.
you see, it has a price as $59, but if you're European, it would have a price in euros.
If you were in India, you would have a price and something else.
So in order to pull that, all that information in, this was usually fast, but periodically
we'd have to hit our credit card processor for places that are less common.
I tried to pre-compute all this, but it's like combinatorially out of control.
So if you're like from a certain part of Greece where there's a certain tax that's different
than another part of, you know, like all of that factors into what shows up on this page.
So I just showed them without prices and like, well,
what if I could reload, like show the page and then recompute the page with prices.
And if it takes 10 seconds for 50 API calls to the credit card processor, so be it.
And maybe you'll see it, maybe you won't.
But if it's already seen that and it's saved to the database, we'll just show it to you basically.
Wow.
Really, really quick.
So watch this.
If I refresh it, you can see that it kind of flickers for a second and then the prices come back.
Cool.
So all of that is in HTMLX.
And if you look at the implementation of it, three lines for that entire client side implementation
of show the page without prices instantly, start a computation to figure them all out,
get the answer, and then rebuild the page out of that.
Just div, hx get, some URL, hx trigger to load, render partial.
This is the implementation that both shows it on the first load without prices and then refreshes
it and loads it with prices.
Those three lines and one of them is a slash div.
Well, that's pretty cool.
Is that insane?
Yeah.
So, yeah, hx for the win.
Just want to.
Nice use.
Encourage more people to use that.
It lets you do more Python and less JavaScript, right?
Because most set implementations on the server, which is where it's all Python.
Yeah.
And one of those three lines is just the closing of the div.
So it's really like two lines of code.
It's really like two lines.
It's incredible.
Yeah.
All right.
Another one.
Something I've been recently using.
And some people will be like, Michael, where have you been all this time?
Why have you not done this?
I'll put this out to you as my test candidate.
Did you know that if you find yourself sitting down to the terminal, SSH into a server, running
a command, and then leaving often, even if that has like text output and all sorts of responses,
colored text output, like rich or whatever, you can just run that on your machine using
SSH to execute a command remotely.
Is this news to you?
No.
So you can say SSH for people who don't know.
You can say SSH user at host, and then in quotes, some command.
So like if you want to say tail your log and see what's happening on your server, instead
of logging into the server over SSH and tailing it, you could just create an alias that says
SSH user at host, do the tail log thing, and you just type it locally and just boom,
you're telling log.
It's beautiful.
Or whatever you want to do.
And if you want to run multiple commands, just separate them by semicolons.
Get a little alias for that bad boy, and off you go.
Yeah.
Nice.
So anyway, that's one of my extras.
I use it for, so the reboot is built in, but we have an extra command that we do for restarting
the, we have an application that we often have to restart.
So doing a single command to SSH and run the restart to restart all the software.
Do that a lot.
So.
Yep.
Cool.
All right.
I told you it's extra, extra, extra.
There's still more extras.
Okay.
We got time.
All right.
Yeah.
These are short.
So polyfill.io is a CDN, I believe for a JavaScript.
Polyfill is if a browser doesn't support a feature, but you can implement it in JavaScript
on top of the features that are there.
That's a, because include a script that's a polyfill, like add features to an old one,
an old browser.
Okay.
So apparently, according to Bleeping Computer, this thing has been impacted by a supply chain
attack where a Chinese company acquired the domain and then the script was modified to
redirect users to malicious and scam sites.
No.
And everyone who had that in their web app, 100,000 different websites, the CDN got a
new version of the script for you.
Oh, geez.
Which means it's time for required reading from Wesley Apticker Castle's reasons to avoid
CDNs in JavaScript.
I'll do my highlighted one here.
Oh, wow.
Look, systemic risk.
It says one of the CDNs out there supports 12.5% of all websites.
If that goes down, having 12.5% of the internet vanish is silly.
We've swung too far towards away from resiliency as a society.
Privacy, obviously, because they can track everyone who makes a request for that and coordinate
that across browsers and sites.
They see speed, but if you're using ACP2, it doesn't matter that much.
You could use your own CDN security.
This points out that modern browsers have sub-resource integrity.
Basically, you put a hash onto it, and if you're using a CDN, put the hash in there.
That way, if something like this happens, it won't load the page.
Like, the browser's like, no, it doesn't match.
I'm not running this, which is good.
Unfortunately, this doesn't work for libraries that are split into multiple pieces, you know,
where one thing requires another type of deal as part of it.
So what to do instead?
Just download it, is what they say.
Although what we do, Brian, over at Python Bytes, is we just download it, but then we serve that content back over our own CDN at bunny.net.
Well, it's not ours, but the one we use at bunny.net, which still gives it all the global reach, but we control whether or not it changes other people, which is awesome.
And just to keep beating the drum, major ad networks are basically malware delivering funnels, and don't feel bad about ad blockers.
Mac users served info stealer malware through Google ads, so why not?
Who wouldn't want that?
Oh, geez.
So that's an article on Ars Technica you can check out, but that's my extra, extra, extra, extra, extra hear all about it.
Okay, nice.
You got extras?
I do, but I've got a link that I can't show.
That's okay.
So I want you to go to the, like, either in the notes or the private chat and click on that link, and we'll talk about it.
It's called, I will effing pile drive you if you mention the AI again.
So it's just a, it's a funny reaction to all this ChatGPT stuff and AI and everything.
And it's interesting, it's the interesting position.
So this is somebody that was studying data science.
They're in, I think they're in college, and they're doing grad, I think grad school stuff now, doing a master's thesis.
But he's kind of sick of a lot of the hype around AI.
So there's, it's just an interesting take on it.
And it's, it's so funny.
Like, if you'd like to have an alternate, if you're tired of all the hype around AI, and you'd like to, you know, read some, somebody else's perspective, click the link in the show notes.
And it'll be an interesting read for you.
The reason why I'm not showing it is because I want to keep this child friendly and safe for this pod, for the live feed.
So anyway.
Thanks, Brian.
Well, check it out.
That's my, that's my only extra.
All right.
Well, let's close this out with a joke, huh?
All right.
Yeah.
Let's do that.
By the way, I have this AI fatigue as well.
It's like, chat TVT is cool.
Llama 3 is cool.
But like, not everything needs to have AI in it.
And certainly a lot of times software use has just like easiest all persistent bugs because the whole team is like on an AI mission.
You're like, I don't want any of this junk.
Could you just make it when I click this that it works?
Yeah.
You know?
All right.
Off to the joke.
Over on Reddit, we have something called the HTML hacker.
We just talked about like the malware, right?
So this is sort of two sides of the picture.
Both people don't see either side, really.
So woman, she says, my boyfriend is a programmer.
He'll hack.
He says, don't mess with me.
My boyfriend is a programmer.
He'll hack your world into oblivion.
Meanwhile, the boyfriend on his computer, Google, how to declare variables in HTML.
Yeah.
Both things can be true at the same time.
He also could be a hacker and still don't know how to declare variables in HTML.
You never know.
I don't know how to declare variables in HTML.
Can you declare variables in HTML?
No.
Okay.
But you can in like modern CSS and, you know.
Well, okay.
So one of the things I think is funny about this is because sometimes in the movies,
you'll see somebody like pouring through lines of code and then you look at it and it's
just like the view source of some web page or something.
It's like, that's not like, you're not hacking anything.
Guys, guys, I found the source to this web page.
I'm going in.
Yeah.
Wow.
And I've got the JavaScript next.
Oh my gosh.
I can't believe they just published this and don't hide it.
Yeah.
So anyway, that's funny.
Yeah.
Anyway.
All right.
That's it.
Thanks a lot for a great episode.
Yeah.
Fun.
As always.
Catch you later.