lowleveldata comments on Python tutorial moment

Python tutorial moment (lemmy.world)

submitted 2 years ago by devilish666@lemmy.world to c/programmerhumor@lemmy.ml

56 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] lowleveldata@programming.dev 41 points 2 years ago (5 children)

That's what libraries are for. I'm no security expert and the sensible thing to do is using a library instead of taking a class.

parent

hideshow 5 child comments

[–] bort@sopuli.xyz 25 points 2 years ago* (4 children)

I’m no security expert and the sensible thing to do is using a library instead of taking a class.

Counterpoint: "not knowing your libraries" + "blind trust in the maintainer" will give you stuff like this: https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in

(the thread itself is worth a read. But also very impressive is the list of big players who fell for exactly this mentality)

parent

hideshow 4 child comments

[–] gears@sh.itjust.works 7 points 2 years ago (1 child)

Jesus that was one hell of a thread

parent

hideshow 1 child comment

[–] anguo@lemmy.ca 3 points 2 years ago

I dont want to see the words "low quality tooling" ever again.

parent

[–] unique_hemp@discuss.tchncs.de 4 points 2 years ago

Love the part where he claims that if your users are authenticated, it's not untrusted input. I mean, surely you trust all of your users to run any code on your server, right?

parent

[–] Gabu@lemmy.ml 3 points 2 years ago

Impressive and unsurprising. As soon as you start getting complex libraries with multiple dependencies it becomes nearly impossible to review everything. At one time I had an interest in contributing to some AI libraries, but they're a mess as soon as you go looking for points of improvement.

parent