undefined | Better HN

0 pointsTZubiri1y ago0 comments

> (Incidentally, I don't get very much done.) Lol, that's definitely part of the tradeoff of security in life.

> I don't use Java I didn't use Java either, but whatever I was using at the moment (Python) could have been anything, if I stayed in my other job or gotten a different one I could very well been using Java and been the one that installed the thing.

>Python script, but I won't use `http.server`. (Incidentally, I don't get very much done.)

Interesting, I use http.server or the Tcp socket server thing, but I consider myself to be in the extreme, there's still people that use Flask (and I do partake ocasionally) or things like Django, Spring, Next,etc... Same with binaries like Apache, Nginx.

I mean you gotta use something, and if you go too far on the deep end, you get the risk of introducing the vulnerabilities yourself, (in addition to the risk of getting nothing done as you mentioned). I know my limits I wouldn't implement cryptography for example.

0 comments

wizzwizz41y ago

I consider it safe to use ASGI / Uvicorn or (if you're careful about which extensions you install) Django. Python has fewer, less-prominent built-in footguns than Java, so even though it's less secure in principle, it's easier to write / audit for security in practice.

Not getting very much done isn't because I practice secure software development. It's easy to write secure software that works. I don't get much done because I try to find new ways to write secure software: experimentation and tool-building takes up a lot of my time, when I should really be writing hacks, documenting them, and moving on.

Never roll your own crypto, unless you understand systems programming on that platform/arch very well: modern systems have all the side-channels, and take great pains to subvert your attempts to mitigate them.