Software Unscripted
Gleam 1.0 with Louis Pilfold
Tue Apr 02 2024programming languagespackage managementsecurity risksresilient systemsupgrading applicationsconveniencesandboxingWebAssemblycompilershosting challengesKotlin languagetutorialsoptimizing downloadsOTP implementationsystem upgrades
Description
This episode covers topics such as the release of Gleam programming language version 1.0, upgrading dependencies and package management, security risks in package management, operating centralized indexes and decentralized systems, designing resilient systems, minimizing dependencies, upgrading applications and managing distractions, convenience, error handling, and sandboxing, WebAssembly and hosting challenges, the Kotlin language and optimizing downloads, optimizing web content and OTP implementation, system upgrades and maintaining type-checked systems, challenges in upgrading messages and fault tolerance.
Insights
Gleam programming language achieves version 1.0 release
The release of Gleam programming language version 1.0 signifies a stronger commitment to backwards compatibility and highlights the importance of proper versioning.
Security risks and considerations in package management
Implementing a system where package URLs must end with a Blake3 hash of the contents enhances security by preventing unauthorized modifications.
Operating centralized indexes and decentralized systems
Decentralized systems like Rock Foundation distribute infrastructure costs and allow package authors to choose where to host their content.
Designing resilient systems and minimizing dependencies
Minimizing dependencies is crucial for stability and functionality in scenarios with limited or no internet access.
Upgrading applications and managing distractions
Specifying exact versions when upgrading applications helps maintain productivity by creating a barrier to distractions.
Convenience, error handling, and sandboxing
There is a need for more convenient and secure sandboxing options in operating systems.
WebAssembly, compilers, and hosting challenges
WebAssembly allows for lightweight sandboxing and hosting tools on a CDN improves user experience but comes with financial challenges.
Kotlin language, tutorials, and optimizing downloads
Interactive tutorials provide a better learning experience and reducing data usage in web design is important for users with limited internet access.
Optimizing web content and OTP implementation
The reimplementation of OTP in Gleam preserves the goals and protocols but changes some primitives like message-sending mechanisms.
System upgrades and maintaining type-checked systems
Building systems that are upgradable on the fly and backward compatible involves challenges and trade-offs.
Chapters
- Gleam programming language achieves version 1.0 release
- Upgrading dependencies and package management
- Security risks and considerations in package management
- Operating centralized indexes and decentralized systems
- Naming products and designing resilient systems
- Designing resilient systems and minimizing dependencies
- Upgrading applications and managing distractions
- Convenience, error handling, and sandboxing
- WebAssembly, compilers, and hosting challenges
- Kotlin language, tutorials, and optimizing downloads
- Optimizing web content and OTP implementation
- System upgrades and maintaining type-checked systems
- Challenges in upgrading messages and fault tolerance
Summary
Transcript
Gleam programming language achieves version 1.0 release
00:03 - 06:22
- The decision to release version 1.0 involved meeting specific requirements and community encouragement.
- Version 1.0 signifies a stronger commitment to backwards compatibility for Gleam.
- Cultural norms and vibes play a significant role in determining what constitutes a breaking change in programming languages like Gleam.
- Elm's approach to semantic versioning, starting all packages at version 1.0, is highlighted as a good practice that encourages proper versioning.
- Louis Pilffel emphasizes the importance of waiting to address problems until they become significant, rather than preemptively making major upgrades.
Upgrading dependencies and package management
05:56 - 12:02
- Major upgrades and big redesigns can cause problems in ecosystems
- Upgrading dependencies' dependencies can lead to complex dependency tree management
- Different languages have varying ways of specifying version constraints for packages
- Design decisions in package management may prioritize certain benefits over potential pain points
- The lack of a package index can impact the searchability of packages in an ecosystem
Security risks and considerations in package management
11:33 - 17:54
- Direct URL imports for packages in programming languages can pose security risks if the URL content changes or becomes compromised.
- Implementing a system where package URLs must end with a Blake3 hash of the contents can enhance security by preventing unauthorized modifications.
- Despite the longer and more complex package URLs due to the added security feature, users have adapted well by simply copying and pasting them.
- The design of package management systems involves considerations such as version ranges, centralized vs. decentralized systems, and operational costs.
- Centralized indices for packages require resources to operate and may face challenges like legal takedown requests for illegal content.
Operating centralized indexes and decentralized systems
17:36 - 23:39
- Operating centralized indexes like NPM can incur financial and time costs due to legal takedown requests and storage expenses.
- NPM faced financial challenges as it grew in popularity, leading to attempts at monetization and eventual acquisition by Microsoft.
- Package managers like CocoaPods face scaling issues when hosted on platforms like GitHub, impacting performance.
- To avoid financial problems, the design of decentralized systems like Rock Foundation focuses on distributing infrastructure costs and allowing package authors to choose where to host their content.
- Content addressable hashing is explored for distributed systems like Rock Foundation to enable sharing across multiple locations without dependency on specific URLs.
- IPFS presents trade-offs in availability and hosting requirements that may not align with user expectations in programming environments.
Naming products and designing resilient systems
23:34 - 29:19
- Considerations around naming products and packages, including potential conflicts and solutions like using domain names as package namespaces
- Discussion on allowing redirects for package names and managing administration through systems of public and private keys
- Importance of designing a resilient system to prevent disruptions in the ecosystem, considering the possibility of major changes in technology platforms
Designing resilient systems and minimizing dependencies
29:02 - 35:22
- The speaker discusses the importance of designing systems to be resilient to changes in technology, such as the potential loss of internet or modern computing capabilities.
- There is a project where people created a simple virtual machine and programming language that can run without digital storage, allowing programs to be printed on cards for use.
- The speaker reflects on the value of investing time in projects with low probabilities but potentially high impact in the software field.
- Minimizing dependencies and constraints in software development is highlighted as crucial for ensuring stability and functionality, especially in scenarios with limited or no internet access.
- The discussion includes considerations about version control and dependency management strategies, emphasizing the benefits of pinning dependencies to specific versions rather than always using the latest updates.
Upgrading applications and managing distractions
35:01 - 40:42
- The podcast discusses the concept of upgrading applications and the importance of specifying exact versions.
- The speaker reflects on how paying for Wi-Fi on planes helps maintain productivity by creating a barrier to distractions.
- There is a conversation about the challenge of finding remote locations without cell phone coverage in the US.
- Trade-offs and incentive structures related to productivity and distractions are explored, highlighting the struggle with interruptions and notifications.
Convenience, error handling, and sandboxing
40:34 - 46:16
- Parenting can change one's perspective on convenience and time management.
- There is a tension between convenience and error handling in language design.
- Scripting languages like Rock offer potential for secure scripting systems with user prompts.
- The desire for convenient and secure scripting solutions exists, but usability is crucial for adoption.
- There is a need for more convenient and secure sandboxing options in operating systems.
WebAssembly, compilers, and hosting challenges
45:51 - 51:45
- WebAssembly (Wasm) allows for lightweight sandboxing and can be compiled by various languages like Rust
- Compilers like Rock and Gleam, written in Rust, can compile to Wasm but also compile Wasm themselves
- Executing Wasm in the browser involves a complex process of sending it from the compiler to JavaScript for execution
- Challenges arise when creating interactive tutorials in the browser due to limitations like not being able to eval ES modules directly
- Hosting tools on a CDN for better user experience and scalability is advantageous but comes with financial challenges for projects like Gleam
- Many programming language creators, especially those outside big companies, work on their projects out of passion rather than financial gain
Kotlin language, tutorials, and optimizing downloads
51:15 - 57:15
- The origin of the Kotlin language within JetBrains is uncertain, possibly starting as a passion project.
- Interactive tutorials in programming languages like Go and Rock provide a better learning experience.
- Concerns about data usage for users with limited internet access are raised, prompting considerations for optimizing downloads.
- Trade-offs between browser-based tools and backend solutions are discussed for different user needs.
- Suggestions are made to prioritize reducing data usage in web design, highlighting the importance of considering diverse user constraints.
Optimizing web content and OTP implementation
56:50 - 1:03:04
- The speaker expresses frustration with the priorities of TC39 and suggests browser developers should use weaker computers to improve performance.
- There is a discussion about optimizing web content for bandwidth and avoiding expensive downloads.
- The conversation shifts to the implementation of OTP in Erlang and Elixir, highlighting a reimplementation in Gleam that allows for type checking.
- The reimplementation in Gleam preserves the goals, abstractions, and protocols of OTP but changes some primitives like message-sending mechanisms.
- The podcast delves into the history of hot swapping systems and code upgrades, with a decision not to include code upgrades in the typed OTP implementation.
- There is a comparison made between design choices in Gleam and Clojure regarding system growth and handling changes.
System upgrades and maintaining type-checked systems
1:02:38 - 1:08:56
- Different approaches to system upgrades: gradual changes vs. complete system overhaul
- Discussion on building systems that are upgradable on the fly and backward compatible
- Considerations for designing channels to support upgrades with forward compatibility
- Challenges and trade-offs of maintaining type-checked systems during upgrades
- Implementation of upgrades in OTP world with actors and message handling callbacks
- Complexities of upgrading across distributed computing clusters
Challenges in upgrading messages and fault tolerance
1:08:27 - 1:10:16
- Upgrading messages on the fly may be challenging due to changes in state
- Erlang focuses on fault tolerance and handling crashes in production systems
- Types are not a solution for all problems in system design
- Discussion about the efficiency of Hex, the Beam package manager