21–28 of 28 posts
Earlier quoted context omitted.
Python applications were widely used before either Google or YouTube existed
Yes, but Python is actually older than Java, yet the boom started much later for Python.
Earlier quoted context omitted.
Python mktemp has been deprecated since 2003. I there’s a race condition that allows a malicious process to slip in a file or symlink with different permissions at the path mktemp returns.
Just for clarity, the race condition seems deliberate. It just returns a path and leaves it to you to create the file.
The warning in the docs (https://docs.python.org/3/library/tempfile.html#tempfile.mkt...) aims to show an example of how to get “just a path” by making and deleting a NamedTemporaryFile, but the example is confusing and has unnecessary steps. Seems like you could just do `with NamedTemporaryFile() as f: path = f.name`.
Also, the warning seems to imply using `NamedTemporaryFile` addresses the race condition, but it doesn’t — the problem exists even for “secure” methods any time you re-use the path after cleanup.
These people are mindlessly applying the results of a static analysis tool which, as most similar tools do, reports ginormous amounts of false positive, and conclude without even a caveat "half of the packages on PyPI have at least one security issue".
That's about as useful as administering an unreliable COVID test that give 50% false positives and concluding "have of the world population has COVID".
This is a really weak paper IMHO, and I would give it a strong -1 if I was a reviewer. These people are mindlessly applying the results of a static analysis tool which, as most similar tools do, reports ginormous amounts of false positive, and conclude without even a caveat "half of the packages on PyPI have at least one security issue". That's about as useful as administering an unreliable COVID test that give 50% f…
Bandit can and has often found vulnerabilities, but its not something you can run and expect accurate results every time.
It requires human review as it will get things wrong and require adjustments to skip false positives at each later run.
The article is about running Bandit over PyPI, but I presume there are other options for this than Bandit. What is everyone's favourite security oriented static analysis tool for Python code?
Earlier quoted context omitted.
Python applications were widely used before either Google or YouTube existed
Yes, but Python is actually older than Java, yet the boom started much later for Python.
First, as the other commenter mentioned, Java was targeted at large enterprise. I remember hearing about Java Beans, and Java Enterprise this and that. It fit with the model of development many were seeing in the late 90s as well- UML diagrams written by some middle manager. There were even tools like Rational Rose that would transform your UML into Java outlines.
Python was an academic language for the most part and so it took time to catch up.
This is the same time period, where Linux was dismissed as a toy or hacker's tool. Serious people worked on Sun Microsystems computers, or Windows NT. Sun and NT were "Real tools for business" and Linux was for people like me- kids in their dorm rooms.
It took time for the industry to catch up, which it did largely out of necessity. A company like Google could run thousands of computers for a fraction of the cost of doing so with NT or Sun, and that gave them a competitive advantage.
With Python, the advantage was different- it wasn't the cost as much as it was the simple convenience and network effect of libraries and a robust community.
Sun could throw money towards documentation, education and marketing. Python was a grass roots movement that only later had a foundation and corporate involvement.
Earlier quoted context omitted.
Yes, but Python is actually older than Java, yet the boom started much later for Python.
There are two reasons I see for this based on my experience. First, as the other commenter mentioned, Java was targeted at large enterprise. I remember hearing about Java Beans, and Java Enterprise this and that. It fit with the model of development many were seeing in the late 90s as well- UML diagrams written by some middle manager. There were even tools like Rational Rose that would transform your UML into Java ou…
Similarly it's now for golang, it is a mediocre language, but because Google is using it, got very popular.