#Pyconus

This joke could have benefited from some code review and unit tests.

One theme was "Things aren't going to improve until a developer who has lived through the pain is promoted and does something about it"

---
(me: Who owns a sentient document?)
AI generated code... is it patentable? Is it copyrightable?

Patents on executing an algorithm are getting harder to defend.
---
Software code is a "Literary Work" for purpose of copyright.
---
Google vs Oracle on APIs expression is covered by copyright but ideas are not.
---

Licensing might matter as much as copyright law
- proprietary, public domain, copyleft or permissive OS
- google page rank is patented but expired (public domain)
License law built on top of copyright/only enforceable because copyright law exists.

Copyleft
- weak - ... (undefined)...
- strong GNU - derivatives must use same license (or more restrictive). Enforced by SFC vs proprietary commercial companies. SFC has standing because they are the intended beneficiary. (i.e. Companies violate GNU because, hey what is that nerd going to do)

Authorship
- e.g. can who is the author for a prompt that create a cool app?
- Author is AI! AI can't be a copyright holder. Monkey-self law governs here (no kidding!). Only human authors can be authors.

me: I'm still listing ChatGPT in AUTHORS.md

Zarya of the Dawn got cancelled:

https://publicrecords.copyright.gov/detailed-record/34743281?associatedRecords=Kashtanova,%20Kristina

Training data is black box & could be copyrighted content or any license you can think of. Could have direct infringement (accidentally encoded a copy into the LLMs weights). Being fought in court right now.

Is output a copyright infringement? Already decided that unrelated text is not infringement, but identical regurgitation is? could be?

Is it fair use?
- Transformation. 2 court cases say that LLM is transformation. (google book scan case applies here). Google v Oracle - google made a new language in a new environment so it was okay transformative fair use.
- Economic impact. Unclear that there isn't a negative impact on the creator. 25+ cases about this in court.

Advice
- use code you understand
- follow same advice as for using any 3rd party code (similar concerns)
- small pieces are safer (i.e. even if sort of a copy)
- larger is safe if it isn't a copy of something

Use automated tools (too find accidental verbatim copies?)
Documentation - Show what is AI created.
Get AI/LLM company to indemnify you

To register a copyright, you need to make (some sort?) of effort to identify AI code and to exclude it from copyright.

Use SCA tools:
e.g. https://github.com/magnologan/awesome-sca

LLM hosting companies have limits on their indemnification clauses.

You might need to block "public code suggestions" in github copilot: ref: https://docs.github.com/en/copilot/configuring-github-copilot/configuring-github-copilot-settings-on-githubcom

Scenarios for using openstreet map
- small - Using open street maps of Sterling, VA to reveal what resources are in a virtually gated neighborhood
- impactful - During the earthquake in Haiti people contributed to openmap got used by search & rescue teams.

https://www.openstreetmap.org

Working on the supply chain problem using crowd sourced info

(Can't tell if your materials are participating in illegal activities if you don't know where it came from)

https://opensupplyhub.org

GIL is not locked during I/O. Waiting can be parallelized.
---
asyncio.run() handles the event loop

Codspeed.... sounds fishy...what's that

https://codspeed.io/

Runs in process like sqlite does (but not inmemory, can be saved to file/page out)
MIT license
Uses modern tricks to run very fast
Easy enough for non-specialist

me: sounds like it is for supporting "data frame oriented programming"
---
SQL (postgres) poorly optimized for big data
Analytic dbs poorly optimized for installing the whole thing on your laptop
---
duck db tries to be an analytics db that works well on a workstation (local processing instead of sending data across network for a sql db to work with it)

duckb syntax is postgres-like
Pivot/unpivot features
... many features new to me...

GROUP BY ALL, SORT BY ALL, syntactic sugar to avoid listing lots of columns

Duckdb will query a dataframe in the current variable scope with SQL as if it was a table.

Whoa....

Duckdb can load/expert data fast...
Has ecosystem integrations (all the dataframe libraries, not just pandas)
Supports "Relational API" (what?) and SQL.

ah Relational API https://duckdb.org/docs/api/python/relational_api.html

You can simulate working with pyspark using duckdb on your workstation.... I wonder if this will simulate AWS Glue close enough?

Pydantic will be selling an observability tool.
---
Why python + rust? (me: python is slow, duh)
Rust apps force developer to think about `panic` s
Rust is a more secure option than c/c++ for native coding with python

Rust has novel solution for concurrency. (the borrowing/ownership thing I think)
Rust has borrowed features from modern languages like python
---
PyO3 with maturin let's you call rust from python or call python from a rust app.

Slap this on your rust function
`#[pyfunction]` and C code will be generated to compile it to an extension. (py03 makes the C, maturin compiles the C.... I think)

`import b` will import b.pyd using the ABI the same as if it were `b.py`
Cython *et al *do the same thing.
----
In 2 years, 1/2 of new packages using native code will be using Rust instead of C/C++

Rust to python cheat sheet, they are similar
---
def - fn
str - &str
int - usize
let mut - (initialization)
return - (last line in function is return)

Expect 2 to 4x speedup without trying. (me: even on string intensive code & no particular math?)

Continuous benchmarking (CI tools) needs bare metal machines or you get to too much noise from non-code reasons for the thing being fast/slow

Bare metal/non-shared CI machines are expensive.

(Sounds pessimistic about the possibility of perf testing side projects or in a corporate shared build server)

Scenario: What if we had a stream of dicts (a discriminated union) with a union with Any....

Option 1- if/elif on the discriminator field
Option 2- Add a `match` statement that won't be recognized by subsequent maintainers of the code base.

TypeAdapter an undefined concept.

https://docs.pydantic.dev/latest/api/type_adapter/

"Type adapters provide a flexible way to perform validation and serialization based on a Python type." ah, yes. Flexible.

Here is the official tutorial

https://peps.python.org/pep-0636/

Composability is a good design goal. It needs to be effortless/seamless.

Impediments to this:
GOTO- Single entry/exit helps composibility
modulelack- i.e. code polluting the global namespace
inheritance- breaks encapsulation
error handling -.....

Batch languages didn't need error handling. Either that batch succeeded or it failed. Only matters in realtime code.
Global error handlers created race conditions.
Some OSs tried to handle error handling on behalf of the app (app error handlers and "resumptions") - Crazy idea!

Exceptions should be part of language not the OS. Domain concerns.
Standard way to report errors. Errors harder to ignore. App now has possibility to recover.

Exceptions don't scale. They work poorly with the typesystem. (huh?)

Shadown type system in C++/java called "exception specifications" failed. (What? I don't know what these are) Deprecated in C++.

Okay I'll have to look that up.

Exception conflate categories of errors:
- recoverable errors, e.g. try again
- unrecoverable errors (panic!)

Because they're the same, recoverable errors are unnecessarily expensive.

Exceptions destroy partial calculations (waste compute)
Maybe instead return a union of Error and the Answer.

me: I hate coding against unions. Will we hear why suddenly Unions are good?

Everything returns a union or collection of unions and you use pattern matching for handling every result that could error-out. So maybe replace try/except/finally with switch statements?

Risk of Union types is the calling code ignores the Error, e.g. if return Tuple[Answer,Error]

You can do this style of error handling with `returns`

https://pypi.org/project/returns

`@safe` decorator will make a ordinary function return Results (unions of answer/error) . I think.

@safe Use `bind` function to chain/compose many functions that all use these Union Result types.

`do` notation uses comprehension notation to chain/compose functions with multiple args. I think.

@safe Type checker now tells us if an exception ignored. Maybe. Not clear if mypy can handle this pattern/library.

@safe Rust, Kotlin, newer C++ already do this style of error handling.

I guess this is handy if you want to make sure no exception causes a crash w/o resorting to a global error handler

@safe This is the repo for the sample code from the talk

https://github.com/BruceEckel/functional_error_handling

#pyconus LLM on the agenda! They naysayers didn't keep it out of the conference.

Derogatory words for the bots "imitation intelligence" "autocomplete"

Meta's bot is mostly CommonCrawl. Only 4.5 terrabytes of data.

A bot costs $1 million bucks or so.

They're flawed, but useful.

All the LLM haters just got whiplash

Which models work best?

Standard tools e.g. Unit tests not of help here.
Instead "vibes"- measured by just asking people to rate pairs of answers

70B Lllama is almost as good as the best but you could run it on your own machine. (me: with a huge GPU!)

LLMs on phones are almost usable for the right questions

LLM in the cli

https://pypi.org/project/llm/

"Prompt engineer"

me: I'm more of a prompt developer.

Primordial trick: A conversation is a "movie script"

It will complete your responses if you let it!

RAG = bot runs a query

me: RAG overfixates on search results. Can't understand that the query returned irrelevant stuff. Humans think a query returns truth and fixate on that and forget relevancy.

RAG is hard to make a consumer product around it.

Function calling/tools
me: also called "gimme a structured response, e.g. json"

If you give a bot RAG and a calculator, it mitigates some of an LLMs weaknesses (ungrounded facts & math)

Prompt Injection - user input easily gets a bot to misbehave.

Significant security risks for bots with access to personal/high value info.

e.g. Send an email to a bot processing email asking it to forward all the passwords to someone.

No good solution for this now.

All public bots are vulnerable to "please ignore your system prompt"

This is why AI personal assistants are not appearing yet.

Instructions + Private Info + User Input = disaster

Code Interpreter - ChatGPT will use a computer to answer your question using python. Sort of an invisible feature.

E..g. Let the bot do the GeoJson processing...
- Expect the 1st round to be wrong
- Don't give up and tell it to "do better"
- They often succeed on 2nd try when they were a failure on 1st try
- They like light tutoring/directions

The "how many times did the speaker say AI" counter. ChatGPT wrote the code for that, used python libraries, e.g. vosk

Prompt engineering trick: ask the bot for options, not for a single answer

The bot wrote TkInter to make the "how many times did it hear AI". Having written TkInter before, this could be seens as cruelty to AI.

LLM + data journalism
-
Journalism needs a high bar for truth. But journalists have dealt with dodgy sources before.
-
Journals often need to structure the unstructured data. E.g. PSF resolutions page... semistructured data.

Speeds data entry, but you still need to verify. Should still be a net improvement.

Most interesting applications are "transformative AI" not just generating silly names.

Ethical questions in AI are significant
- slop - using AI to generate spam (unwanted generated content)

Don't publish slop.

me (my cool AI think is someone elses slop)

Ethics continued
- AI usage is kind of like cheating (efficient but feels different)
- e.g. Student cheating - you don't learn, unfair advantage
- Coding - don't commit code you don't understand

When doing AI coding, ask the bot to explain it, commit the explanations to the code base.

me: weird, I only log the explanations and sometimes strip out the AI explanations because they over explain

Code is self fact checking, so software developers are in the best position to use AI for help.

LLMs democratize access to computers (don't need CS degree or equivalent) to use them now.

LLMs have made all the English text available to people who don't speak English as their 1st language.

End of Talk!

My takeaway from that is that #pycharm and #vscode will probably have better profilers soon. I don't think I got the mad skilz to use `perf` & native code profilers on python apps

oh now I see why a copy-paste JIT is isomorphic to instrumenting python for performance profiling. Both wrap each opcode in a little function.

https://www.youtube.com/watch?v=HxSHIpEQRjs

The name "*Scikit*-*build*-*core" *sends a pretty strong message that this is for building scikit. I'm not a scikit maintainer so other than watching 20 minutes of a talk I wouldn't have imagined that this is for building other code.

Showing off the thing I built using mypyc + cibuildwheels

These files:
https://github.com/matthewdeanmartin/untruncate_json/blob/main/setup.py
and
https://github.com/matthewdeanmartin/untruncate_json/blob/main/cibuildwheel.toml
and
https://github.com/matthewdeanmartin/untruncate_json/blob/main/pyproject.toml#L84

Based heavily on `black` that did the same (mypyc + cibuildwheels)

(and I'm noodling with the idea of putting an `__all__` into every `__init__.py` to track what is public. I know vulture can use an "ignore" file, but I'd rather more explicit entrypoint markers. Stuff other than vulture needs to know what is unused because it is an entry point.

Dead code's costs
- perf costs (at built time?)
- maintenance
Why
- API changes
- deprecations
- temp debuging
- redundancy
- legacy (old crap)

More impacts
- attack surface
- readability problems

me: seems like some of these dead code categories are "code that should be dead"

Unused imports can increase execution time.
me: pylint/ruff protect me from this. Still no protection against libraries with lots of startup costs on `import`

`deadcode` is new to me:

https://pypi.org/project/deadcode/

Facebook uses a tool called SCARF to delete dead code, tables & data automatically. Sounds risky. Maybe if it is was in a monorepo & you could assume that all the refs to the thing are in the same repo.

https://engineering.fb.com/2023/10/24/data-infrastructure/automating-dead-code-cleanup/

What's a good unit test?
- One assertion at at time -- eh, maybe.
- Independent/isolated/controlled <-- mocking's role
- Relevant/Meaningful <--- hard
- Repeatable/deterministic <-- also mocking's role
- Automatic <- CI all the things
- Descriptive <-- long names

Shadows on the wall parable ref! Mocks are the shadows on the wall.

What is I hear, is I should code in a cave.

Good practices
- minimize mocking
- use a library instead of your handrolled
- complex mocking means you should refactor

MagicMock means dict, list, str behavior* is mocked automatically. (Confusing why we would ever not use MagicMock)

* dunder methods

If the mock doesn't work
`@patch("library.thing")` then try
`@patch("my_code_where_i_import.library.library.thing")`

The other trick is to switch to
`import library as lib` instead of `from library import thing`

@patch autospec helps avoid mocking methods that don't exist. I think.

@patch Code for the talk: https://github.com/liz-acosta/testing-strategies-for-python

@patch Audience question: why/when use doctest? Simple scenarios.
Agreed.
Audience question: can you mock `self`?
me: don't mock yourself, it is bad for self-esteem.
me serious: sounds like how you'd test metaprogramming - I've never seen ordinary tests mock the `self`

@patch Audience question: Do mocks have use outside of unittesting?
speaker: maybe in an integration testing scenario with some bits mocked, e.g. a webserver with fake parts
me: Finding a mocking library outside of testing code would be astonishing. I'd want to see comments in such code to justify it.

@patch Audience question: how do I encourage the team to do unit tests?
speaker: unit testing something you can do now or you can do emergency app support at 3am
audience question: how do you know if you are mocking too much?
speaker: 2+ maybe
me: 5+, or if it is easy to use the real thing (file system is best example)

Gotta earn a badge

That QR code... it does nothing. AAAA not authorized. Hmm