News for hackers. Stuff that matters.
Re:The xz attack shell script by _a_a_a_ on Wednesday April 03, 2024 @04:30AM (#39914871)
Can you point to 3 python foot guns, for instance?
Re:The xz attack shell script by s1dev on Wednesday April 03, 2024 @04:55AM (#39914977)
I’m generally in agreement with the anti-bash camp, but I can name about that many :)

- Mutating default arguments to functions, so subsequent calls have different behavior

- Somewhat particular rules around creating references vs copies

- Things that look like lambda captures but aren’t quite

Re:The xz attack shell script by sanderjd on Wednesday April 03, 2024 @08:12AM (#39916415)
Yep, every language has footguns and other kinds of quirks, but I contend that the "footguns per character" ratio in shell is unusually high. (It is not unique in having a high ratio though; other popular languages, like c++ for instance, also have this issue.)
Re:The xz attack shell script by eitland on Wednesday April 03, 2024 @03:56PM (#39922262)
The worst (level of nastyness * usage) offenders all probably have a reason for being popular despite their flaws:

- Bash: installed everywhere you want to work (yes, who actually wants to work on Windows ;-)

- C/C++: when speed/size matters there was no alternative except Assembly until recently

- Javascript: until recently this was the most sane option for client side code on the web (Active X and Java applets existed yes but managed to be even worse.)

- PHP: Low cost hosting, Function-As-A-Service way before that became popular, shared nothing architecture, instant reload for local development bliss

Re:The xz attack shell script by sanderjd on Wednesday April 03, 2024 @04:05PM (#39922385)
Couldn't agree more.
Re:The xz attack shell script by _a_a_a_ on Wednesday April 03, 2024 @05:05AM (#39915014)
Touche!
Re:The xz attack shell script by bonzini on Wednesday April 03, 2024 @01:00PM (#39919942)
- string vs. list "in" ('a' in 'a' is True, but 'a' in ['a'] is also True)

- cannot know which object attributes are private or public (and some classes use settable properties so you can't say "just don't set any attributes on non-dataclass objects")