News for hackers. Stuff that matters.
Re:Django 1.8.2 security release patches unusually dangerous... by GlennCSmith on Wednesday May 20, 2015 @02:30PM (#9578195)
This is an unusually dangerous security bug. Definitely agree with the Django team that all users of Django 1.8 should upgrade as soon as possible.
[ Parent | on HN ]
Re:Django 1.8.2 security release patches unusually dangerous... by codygman on Wednesday May 20, 2015 @03:25PM (#9578599)
Adding to my list of security vulnerabilities that static typing would have prevented.
[ Parent | on HN ]
Re:Django 1.8.2 security release patches unusually dangerous... by jtokoph on Wednesday May 20, 2015 @05:57PM (#9579601)
Isn't an empty string still a string?
[ Parent | on HN ]
Re:Django 1.8.2 security release patches unusually dangerous... by codygman on Wednesday May 20, 2015 @06:13PM (#9579694)
Right, the issue here is just using null or "". You could use an Optional or Maybe type here. Even better you could define:

    data SessionKey = ValidSessionKey | InvalidSessionKey
Then the developer making the modification code would have been much less likely to type "InvalidSessionKey" whereas the None/"" behavior is just an idiom. The problem here is that the domain knowledge of: "" is a valid session

wasn't communicated by the code.

[ Parent | on HN ]
Re:Django 1.8.2 security release patches unusually dangerous... by omouse on Wednesday May 20, 2015 @05:09PM (#9579323)
still stuck on Django 1.6.x; also stuck with Python 2.7.x; fear is the order of the day when it comes to upgrades.
[ Parent | on HN ]