jmp schrieb am 02.10.2015 um 11:03: > Safety is like speed optimization, you care about it only when it can be a > problem. And the vast majority (there's a recent trolling thread about the > equivalent percentage of vast majority if you want to have fun) of python > code may run on trusted networks. Meaning it's probable you are wrong when > assuming security of a python snippet is a concern.
Writing code "for internal use only" is ok, but there is never a guarantee that some of that code won't be reused elsewhere, in an entirely different context. Or that someone comes up with the idea of adding a REST API frontend, now that there is a command line interface [1]. If that happens, I assure you that at least in some cases (be it the "vast majority" or not) there will be no thorough security audit up-front. Because, you know - it's code that works and is production proven already. Possibly for years and years, and through generations of employees, all experienced and trusted. What can possibly be wrong with such code? So, it's acceptable to write such code under certain conditions, but at least someone should leave a visible comment somewhere (as Peter rightfully did in this case) that the input is not safely validated, so that future generations of programmers can see immediately that a) security hasn't been a concern when writing it and b) the author was in fact not a complete moron, not knowing a bit about the basics of input validation. It really helps in trust building to find such comments from time to time. Stefan [1] mainframes on the Internet, anyone? -- https://mail.python.org/mailman/listinfo/python-list
