ItsDangerous • Hacker News Board

Re: ItsDangerous

#21

Post by throw10920 » Fri, Dec 17, 2021, 5:15 PM UTC

diogenesjunior wrote: post #4

I wonder about OP's reasoning for submitting this to HN. `itsdangerous` has been around for a while and is actually required by `flask`.

Nowhere in the HN guidelines[1] is it required (or even recommended) for a submission to be new or even recent - there are popular submissions going back to the 1900's and others that have hit the front page a dozen times because they're timeless or little-known.

The fact that the submission has 73 upvotes (as of this comment) and that I found it novel and interesting suggests that it's rather on-topic, and interesting and provides value to others, and it's certainly "Anything that good hackers would find interesting. [...] anything that gratifies one's intellectual curiosity."

Meanwhile, I don't find much value in your questioning why a popular post was submitted in the first place.

[1] https://news.ycombinator.com/newsguidelines.html

Re: ItsDangerous

#22

Post by zachthewf » Fri, Dec 17, 2021, 5:39 PM UTC

monkeybutton wrote: post #11

Once upon a time, the company I was working at was going through an acquisition and in part of the due diligence process the acquirer asked us for a complete list of all software and dependencies in our technology stack. The only one my team heard back about was ItsDangerous.

What did you hear about it?

Re: ItsDangerous

#23

Post by fiddlerwoaroof » Fri, Dec 17, 2021, 5:46 PM UTC

mrweasel wrote: post #17

reedf1 wrote: post #16

Earlier quoted context omitted.

Coming from a C++ background I am totally confused by the constant flaming of python's package management.

I use Python pretty regularly, and previously worked as a Python developer. I never had any issues using just pip and virtualenv. Both are bundled with Python and does exactly what I expect them to do. Others praise the package managers of other languages, while I'm just left with the impressing that the combination of pip and virtualenv is the only solution that makes any sense.

Yeah, I stopped using Python regularly in about 2015, but even then I never had any significant problems with pip + virtualenv and I always was a bit mystified by everyone’s complaints about “Python package management”.

Re: ItsDangerous

#24

Post by divbzero » Fri, Dec 17, 2021, 6:01 PM UTC

throw10920 wrote: post #21

diogenesjunior wrote: post #4

I wonder about OP's reasoning for submitting this to HN. `itsdangerous` has been around for a while and is actually required by `flask`.

Nowhere in the HN guidelines[1] is it required (or even recommended) for a submission to be new or even recent - there are popular submissions going back to the 1900's and others that have hit the front page a dozen times because they're timeless or little-known. The fact that the submission has 73 upvotes (as of this comment) and that I found it novel and interesting suggests that it's rather on-topic, and interesti…

The reminder that the library is used in Flask was helpful even if the questioning wasn’t.

Re: ItsDangerous

#25

Post by monkeybutton » Fri, Dec 17, 2021, 6:17 PM UTC

zachthewf wrote: post #22

monkeybutton wrote: post #11

Once upon a time, the company I was working at was going through an acquisition and in part of the due diligence process the acquirer asked us for a complete list of all software and dependencies in our technology stack. The only one my team heard back about was ItsDangerous.

What did you hear about it?

They were asking what it was for. I suspect the person reviewing the list had no idea what they were doing. If there's going to be security threat lurking in there its not going to be in the package named "itsdangerous", its going to in the one with a typo in the name.

Re: ItsDangerous

#26

Post by josefx » Fri, Dec 17, 2021, 6:18 PM UTC

reedf1 wrote: post #16

sigmonsays wrote: post #9

[flagged]

Coming from a C++ background I am totally confused by the constant flaming of python's package management.

Going by https://explainxkcd.com/1987/ the problem seems to be half a dozen possible package managers that each manage their own python environment.

As a Linux user it was a bit weird, I use apt to install packages but for some reason I need pip for certain python packages? I barely use python so I am still not sure if there is anything ensuring that those don't conflict.

Re: ItsDangerous

#27

Post by luhn » Fri, Dec 17, 2021, 6:42 PM UTC

formerly_proven wrote: post #5

akavel wrote: post #3

How does this differ from JWT? (sincere question not having deep knowledge about JWT either)

This is much simpler than JWT; you'd have a hard time to implement this incorrectly as opposed to JWT. I'm not in the loop, but JWT also used to specify an entire tirefire for crypto algorithms. Probably still does.

The big problem was that JWTs specifies the signature algorithm alongside the signature. Some naive implementations allowed all supported algorithms by default... one of which is "none". So an attacker was able to create a key with no signature and the application would accept it. I think nowadays all implementations require you to specifically whitelist the allowed algorithms.

But yeah, JWTs (technically JWS) overlaps with ItsDangerous, but ItsDangerous is much simpler and has fewer footguns.

Re: ItsDangerous

#28

Post by mikepurvis » Fri, Dec 17, 2021, 7:45 PM UTC

mrweasel wrote: post #17

reedf1 wrote: post #16

Earlier quoted context omitted.

Coming from a C++ background I am totally confused by the constant flaming of python's package management.

I use Python pretty regularly, and previously worked as a Python developer. I never had any issues using just pip and virtualenv. Both are bundled with Python and does exactly what I expect them to do. Others praise the package managers of other languages, while I'm just left with the impressing that the combination of pip and virtualenv is the only solution that makes any sense.

I've likewise been satisfied with virtualenv/pip for years, but I've also done a recent project with Poetry and been quite impressed with how it automates a bunch of the virtualenv bookkeeping. I think it will likely be my choice going forward, but I don't know if it's enough-better to actually want to go to the trouble of porting my plain setup.py/setup.cfg projects to it.

Re: ItsDangerous

#29

Post by diogenesjunior » Fri, Dec 17, 2021, 8:39 PM UTC

throw10920 wrote: post #21

diogenesjunior wrote: post #4

I wonder about OP's reasoning for submitting this to HN. `itsdangerous` has been around for a while and is actually required by `flask`.

Nowhere in the HN guidelines[1] is it required (or even recommended) for a submission to be new or even recent - there are popular submissions going back to the 1900's and others that have hit the front page a dozen times because they're timeless or little-known. The fact that the submission has 73 upvotes (as of this comment) and that I found it novel and interesting suggests that it's rather on-topic, and interesti…

you sound so arrogant and mad lol

Re: ItsDangerous

#30

Post by dang » Fri, Dec 17, 2021, 8:58 PM UTC

throw10920 wrote: post #21

diogenesjunior wrote: post #4

I wonder about OP's reasoning for submitting this to HN. `itsdangerous` has been around for a while and is actually required by `flask`.

Nowhere in the HN guidelines[1] is it required (or even recommended) for a submission to be new or even recent - there are popular submissions going back to the 1900's and others that have hit the front page a dozen times because they're timeless or little-known. The fact that the submission has 73 upvotes (as of this comment) and that I found it novel and interesting suggests that it's rather on-topic, and interesti…

Please edit swipes like that last bit out of your comments here. Your other points are fine.

https://news.ycombinator.com/newsguidelines.html