Once upon a time, the company I was working at was going through an acquisition and in part of the due diligence process the acquirer asked us for a complete list of all software and dependencies in our technology stack. The only one my team heard back about was ItsDangerous.
ItsDangerous
11–20 of 34 posts
Re: ItsDangerous
#12[flagged]
Surely for a web app dependency that is pretty much answered by how your app is deployed. For a Flask app it’s likely one line in your requirements.txt, probably a virtualenv in there too. Honestly, it’s not that hard
Re: ItsDangerous
#13[flagged]
If you have to ask how to install this lib you don't need this lib.
As bad as Python's env management may be your questions is pretty dishonest.
Re: ItsDangerous
#14Re: ItsDangerous
#15Re: ItsDangerous
#16[flagged]
Coming from a C++ background I am totally confused by the constant flaming of python's package management.
Re: ItsDangerous
#17[flagged]
Coming from a C++ background I am totally confused by the constant flaming of python's package management.
I use Python pretty regularly, and previously worked as a Python developer. I never had any issues using just pip and virtualenv. Both are bundled with Python and does exactly what I expect them to do.
Others praise the package managers of other languages, while I'm just left with the impressing that the combination of pip and virtualenv is the only solution that makes any sense.
Re: ItsDangerous
#18Seems like this is just an hmac version of shasum, neat tho.
Re: ItsDangerous
#19Earlier quoted context omitted.
This is much simpler than JWT; you'd have a hard time to implement this incorrectly as opposed to JWT. I'm not in the loop, but JWT also used to specify an entire tirefire for crypto algorithms. Probably still does.
JWT specified all the crypto algorithms; even future ones. They did not intend people to accept more then a very small subset. This was insufficiently well communicated.
Where? RFC 7519 states pretty specifically that only HMAC SHA-256 "none" MUST be implemented. The rest were left up to devs as optional.
Re: ItsDangerous
#20How does this differ from JWT? (sincere question not having deep knowledge about JWT either)
This is much simpler than JWT; you'd have a hard time to implement this incorrectly as opposed to JWT. I'm not in the loop, but JWT also used to specify an entire tirefire for crypto algorithms. Probably still does.
It still does. In practice one of the first things you do is to only accept the specific crypto algorithms you actually need to use. Libraries don't get that luxury because they need to be generic, but at least you as the web service implementer can do it.