Our Django Book is Launched • Hacker News Board

Re: Our Django Book is Launched

#31

Post by raphaelb » Thu, Jan 17, 2013, 7:30 PM UTC

raphaelb wrote: post #25

Is it only for 1.5? Will the best practices carry over for someone looking to understand more about structuring 1.4 projects? I'm working on a 1.4 project right now and while 1.5 sounds great, I'm not sure we're quite ready to upgrade. But we've been looking for a best practices book more recent than the ones covering 1.0 on amazon.

I answered my own question. Bought it, looks great. From the book:

"This book should work well with the Django 1.4 series, less so with Django 1.3, and so on."

Re: Our Django Book is Launched

#32

Post by S_A_P » Thu, Jan 17, 2013, 7:33 PM UTC

pydanny wrote: post #29

lifeisstillgood wrote: post #18

One of my big concerns is user / session security. I have tried to follow and reason through discussions on stackoverflow and much of tpatchek's notes. I would be interested in how "high level" the security chapter is from anyone who has shelled out already. For example I assume I will 1. only use persona or openid (avoids storing passwords in my servers thus making a lot of things much much easier) 2. sessions - sto…

Disclaimer: I'm one of the authors. The book covers 7 pages that gets you started down the road of understanding security. We provide you the stuff you have to know, and point you towards better resources. Keep in mind we aren't professional security experts. If your site needs to be that secure, the best thing you can do is to hire the services of a carefully vetted security expert.

I think a great title for the security chapter should be Django Unchained.

I look forward to reading this- Thanks.

Re: Our Django Book is Launched

#33

Post by julien_p » Thu, Jan 17, 2013, 7:36 PM UTC

This looks fantastic and the timing couldn't have been better for me. It's been a while that I started a new Django project and I was looking for exactly this type of best practices just this afternoon.

Re: Our Django Book is Launched

#34

Post by scottrb » Thu, Jan 17, 2013, 7:36 PM UTC

I've been looking for django books that use 1.4 but didn't find anything, so great news for me. Purchased it right away and can't wait to give it a read this weekend. Thanks!

Re: Our Django Book is Launched

#35

Post by tomg » Thu, Jan 17, 2013, 7:38 PM UTC

pydanny wrote: post #21

tomg wrote: post #19

I didn't see it in the chapter list, so probably not, but is there anything in your book about writing (good) tests?

That's covered of the Chapter 18, which has a Secret Chapter Title.

Thanks!

Re: Our Django Book is Launched

#36

Post by izak30 » Thu, Jan 17, 2013, 7:39 PM UTC

lifeisstillgood wrote: post #18

One of my big concerns is user / session security. I have tried to follow and reason through discussions on stackoverflow and much of tpatchek's notes. I would be interested in how "high level" the security chapter is from anyone who has shelled out already. For example I assume I will 1. only use persona or openid (avoids storing passwords in my servers thus making a lot of things much much easier) 2. sessions - sto…

1. Using recent django (1.4+) will get you _very good_ password storing security. Use HTTPS and you're "as good as anybody else". no persona/openid needed 2. Django has signed cookie sessions (optional to be used) and a solid signing library. This ensures that the data that is returned is the same as the data that was stored. This doesn't mean that a cookie can't be hijacked, so you should take care to have acceptable timeouts and such.

These two things are the building blocks of secure sessions and passwords that work well in distributed systems.

Re: Our Django Book is Launched

#37

Post by greenonion » Thu, Jan 17, 2013, 7:40 PM UTC

This is great. As a new Django developer one of my most frequent Google queries is "best practices about x in django". I am thrilled to finally have so much of that stuff in one place.

Re: Our Django Book is Launched

#38

Post by kefs » Thu, Jan 17, 2013, 7:41 PM UTC

Considering purchasing since I was thinking of diving into django for my next project..

If I buy the PDF now, and you eventually release an EPUB or other format, will I get access to those files (with updates) as well?

Re: Our Django Book is Launched

#39

Post by lifeisstillgood » Thu, Jan 17, 2013, 7:43 PM UTC

jmathai wrote: post #28

wahnfrieden wrote: post #23

Earlier quoted context omitted.

Your 2nd point has significant performance implications, so I wouldn't take that for granted. Your 1st point is pretty controversial and has significant UX implications. Using OpenID instead of just the built-in Django auth or bcrypt is hardly "much much easier" either, it's far more complex to integrate.

I don't think the 2nd point has significant performance implications. If you're not serving up static pages then there's always network calls to be made on the backend. Storing a nonce on the client and looking everything up on the backend is an easy solution which means you don't have to worry about what data you're storing and if that'll be available in the browser. I think it's cheaper to optimize on the backend f…

Thank you - my thoughts too

I cannot trust anything returned from a client so it seems best to Only return one thing from the client

As for a carefully vetted security pro - that's great but I am looking for basic generic best practises (we know that has evolved from md5 hashes to bcrypt but what else is there?)

It seems either a hole in my education or a hole in general common knowledge

Re: Our Django Book is Launched

#40

Post by ahmadss » Thu, Jan 17, 2013, 7:43 PM UTC

Glad to see that you're using Gumroad, but here's an alternative place to sell "previews" of the book -- http://timebx.com/.

Might be worth a shot later down the road when you are trying to sell to a less captive audience (as compared to the HN crowd).