Create a .lua fle from Python

[Stefan Behnel]

jmp schrieb am 02.10.2015 um 11:03:
> Safety is like speed optimization, you care about it only when it can be a
> problem. And the vast majority (there's a recent trolling thread about the
> equivalent percentage of vast majority if you want to have fun) of python
> code may run on trusted networks. Meaning it's probable you are wrong when
> assuming security of a python snippet is a concern.

Writing code "for internal use only" is ok, but there is never a guarantee
that some of that code won't be reused elsewhere, in an entirely different
context. Or that someone comes up with the idea of adding a REST API
frontend, now that there is a command line interface [1]. If that happens,
I assure you that at least in some cases (be it the "vast majority" or not)
there will be no thorough security audit up-front. Because, you know - it's
code that works and is production proven already. Possibly for years and
years, and through generations of employees, all experienced and trusted.
What can possibly be wrong with such code?

So, it's acceptable to write such code under certain conditions, but at
least someone should leave a visible comment somewhere (as Peter rightfully
did in this case) that the input is not safely validated, so that future
generations of programmers can see immediately that a) security hasn't been
a concern when writing it and b) the author was in fact not a complete
moron, not knowing a bit about the basics of input validation.

It really helps in trust building to find such comments from time to time.

Stefan



[1] mainframes on the Internet, anyone?